|
Heute hatte ich vorher nochmal den Process Monitor von Sysinternals gestartet, der mir u.a. zeigt:
"08:44:00,7460582","PlanMaker.exe","3452","Thread Create","","SUCCESS","Thread ID: 1916" "08:44:00,7656699","PlanMaker.exe","3452","Load Image","C:\Program Files (x86)\SoftMaker Office Standard 2012\PlanMaker.exe","SUCCESS","Image Base: 0x400000, Image Size: 0xd7c000" "08:44:00,7657488","PlanMaker.exe","3452","Load Image","C:\Windows\System32\ntdll.dll","SUCCESS","Image Base: 0x77a30000, Image Size: 0x1a9000" "08:44:00,7658621","PlanMaker.exe","3452","Load Image","C:\Windows\SysWOW64\ntdll.dll","SUCCESS","Image Base: 0x77c10000, Image Size: 0x180000" ... (erstes Zugriff auf Datei "pmlog.txt") "08:44:00,8835770","PlanMaker.exe","3452","QueryDirectory","C:\Users\xxxxxxxx\Documents\SoftMaker\pmlog.txt","SUCCESS","Filter: pmlog.txt, 1: pmlog.txt" ... (erstes Zugriff auf Datei "Normal.pmv") "08:44:03,3483758","PlanMaker.exe","3452","CreateFile","C:\Users\xxxxxxxx\Documents\SoftMaker\Templates 2012\Deutsch\PlanMaker\Normal.pmv","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened" ... (m.E. Ende des Planmaker-Starts) "08:44:04,1189566","PlanMaker.exe","3452","CloseFile","C:\Windows\SysWOW64\FWPUCLNT.DLL","SUCCESS","" "08:44:04,1196908","PlanMaker.exe","3452","Thread Create","","SUCCESS","Thread ID: 3516" "08:44:04,1377841","PlanMaker.exe","3452","TCP Connect","xxxxxxxx-PC.mynet:50435 -> softmaker.net:http","SUCCESS","Length: 0, mss: 1412, sackopt: 1, tsopt: 0, wsopt: 1, rcvwin: 66364, rcvwinscale: 2, sndwinscale: 7, seqnum: 0, connid: 0" "08:44:04,1551861","PlanMaker.exe","3452","TCP Send","xxxxxxxx-PC.mynet:50435 -> softmaker.net:http","SUCCESS","Length: 159, startime: 10645, endtime: 10645, seqnum: 0, connid: 0" "08:44:04,3620425","PlanMaker.exe","3452","TCP TCPCopy","xxxxxxxx-PC.mynet:50435 -> softmaker.net:http","SUCCESS","Length: 203, seqnum: 0, connid: 0" "08:44:04,3620879","PlanMaker.exe","3452","TCP Receive","xxxxxxxx-PC.mynet:50435 -> softmaker.net:http","SUCCESS","Length: 203, seqnum: 0, connid: 0" "08:44:04,3627113","PlanMaker.exe","3452","TCP TCPCopy","xxxxxxxx-PC.mynet:50435 -> softmaker.net:http","SUCCESS","Length: 5, seqnum: 0, connid: 0" "08:44:04,3627260","PlanMaker.exe","3452","TCP Receive","xxxxxxxx-PC.mynet:50435 -> softmaker.net:http","SUCCESS","Length: 5, seqnum: 0, connid: 0" "08:44:04,3629465","PlanMaker.exe","3452","Thread Exit","","SUCCESS","Thread ID: 1472, User Time: 0.0000000, Kernel Time: 0.0624004" "08:44:14,0809170","PlanMaker.exe","3452","Thread Exit","","SUCCESS","Thread ID: 4060, User Time: 0.0000000, Kernel Time: 0.0000000"
Der Process Explorer zeigt mir das Planmaker auch den "Print driver host for 32bit applications" (splwow64.exe) startet.,
|